Package net.shibboleth.idp.plugin.oidc.op.profile.flow

Class TokenFlowTest

java.lang.Object

org.springframework.test.context.testng.AbstractTestNGSpringContextTests

net.shibboleth.idp.test.flows.AbstractFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcApiFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

net.shibboleth.idp.plugin.oidc.op.profile.flow.TokenFlowTest

All Implemented Interfaces:

Aware, ApplicationContextAware, org.testng.IHookable, org.testng.ITestNGListener

public class TokenFlowTest
extends AbstractOidcClientAuthenticationFlowTest

Unit tests for the token flow.

Field Summary

Fields

Modifier and Type	Field	Description
(package private) String	clientIdCustomTokens
(package private) String	clientIdJwtAccessToken
(package private) String	clientIdNoIdTokenViaRefreshToken
(package private) String	clientIdPkcePlain
(package private) String	clientIdPkcePlainPublic
(package private) String	clientIdPkcePlainUnforced
(package private) String	clientIdPkcePlainUnforcedPublic
(package private) String	clientIdPkceS256
(package private) String	clientIdPkceS256Public
(package private) String	clientIdRefreshTokenRotation
(package private) String	codeVerifier
static String	FLOW_ID
(package private) String	redirectUri
(package private) RevocationCache	revocationCache
(package private) com.nimbusds.oauth2.sdk.Scope	scope
(package private) StorageService	storageService

Fields inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

clientId, clientIdSaml, clientSecret, clientSecretSaml, issuer, jwtAud

Fields inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

ecKey, END_STATE_ID, endStateId, flowId, rsaPrivateKey, rsaPublicKey

Fields inherited from class net.shibboleth.idp.test.flows.AbstractFlowTest

builderFactory, certFactoryBean, directoryServer, END_STATE_OUTPUT_ATTR_EXPR, END_STATE_OUTPUT_ATTR_NAME, externalContext, flowExecutor, idGenerator, IDP_ENTITY_ID, idpCredential, IP_ADDRESS_AUTHN_FLOW_ID, IP_ADDRESS_AUTHN_MAP_BEAN_NAME, KEYSTORE_FILE, LDIF_FILE, marshallerFactory, parserPool, request, response, SAML1_TRANSFORM_C14N_BEAN_NAME, SAML2_TRANSFORM_C14N_BEAN_NAME, SP_ACS_URL, SP_ENTITY_ID, SP_RELAY_STATE, spCredential, unmarshallerFactory

Fields inherited from class org.springframework.test.context.testng.AbstractTestNGSpringContextTests

applicationContext, logger

Constructor Summary

Constructors

Constructor	Description
TokenFlowTest()

Method Summary

Modifier and Type	Method	Description
private static void	addNonNullValue(Map<String,String> map, String key, String value)
protected void	assertSuccessResponse(FlowExecutionResult result)	Verify that the given result is a success response.
protected String	buildAuthorizationCode(String clientId)
protected String	buildAuthorizationCode(String clientId, String verifier)
protected String	buildAuthorizationCode(String clientId, String verifier, String scope)
protected static String	buildAuthorizationCode(String clientId, String issuer, String userPrincipal, String sub, String callbackUrl, String scope, Collection<String> aud)
protected String	buildAuthorizationCode(String clientId, String verifier, net.minidev.json.JSONObject deliveryClaims, net.minidev.json.JSONObject deliveryClaimsIDToken, net.minidev.json.JSONObject deliveryClaimsUserInfo)
protected String	buildAuthorizationCode(String clientId, String verifier, net.minidev.json.JSONObject deliveryClaims, net.minidev.json.JSONObject deliveryClaimsIDToken, net.minidev.json.JSONObject deliveryClaimsUserInfo, String scope)
protected String	buildAuthorizationCodeWithSid(String clientId, String sid)
protected String	buildAuthorizationCodeWithSid(String clientId, String verifier, net.minidev.json.JSONObject deliveryClaims, net.minidev.json.JSONObject deliveryClaimsIDToken, net.minidev.json.JSONObject deliveryClaimsUserInfo, String scope, String sid)
protected TokenClaimsSet	buildDefaultClaimsSet(String clientId, Collection<String> aud)
protected TokenClaimsSet	buildDefaultClaimsSet(String clientId, Collection<String> aud, Instant authTime)
protected String	buildLegacyAuthorizationCode(String clientId, String... consentedClaims)
protected String	buildLegacyRefreshToken(String clientId, String... consentedClaims)
protected String	buildRefreshToken(String clientId, String id, String rootId, Collection<String> aud, String... consentedClaims)
protected String	buildRefreshToken(String clientId, String id, String rootId, Collection<String> aud, Instant authTime, Instant chainExp, String... consentedClaims)
protected String	buildRefreshToken(String clientId, String id, String rootId, Collection<String> aud, Instant authTime, Instant chainExp, Instant tokenExp, String... consentedClaims)
protected String	buildRefreshTokenWithSid(String clientId, String id, String rootId, Collection<String> aud, String sid, String... consentedClaims)
Object[]	createAccessTokenSecurityTests()
Object[]	createIdTokenSecurityTests()
protected static Map<String,String>	createRequestParameters(String redirectUri, String grantType, String code, String clientId)
protected static Map<String,String>	createRequestParameters(String redirectUri, String grantType, String code, String clientId, String codeChallenge, String codeChallengeMethod, String codeVerifier)
protected Pair<String,String>	getErrorDetaisForJWTValidation()	Get the pair of error code and error description for the error produced via event EventIds.ACCESS_DENIED.
protected String	getSidFromAccessToken(com.nimbusds.oauth2.sdk.token.AccessToken accessToken)
protected String	getSidFromJWT(com.nimbusds.jwt.JWT jwt)
protected String	getSidFromRefreshToken(com.nimbusds.oauth2.sdk.token.RefreshToken refreshToken)
protected void	initializeGrantAndRequest(String clientId, Map<String,String> requestParameters)
protected void	initializeGrantAndRequest(String clientId, Map<String,String> requestParameters, boolean doBasicAuth, com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod registeredMethod)
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.jwt.JWT jwt, com.nimbusds.jose.JWSAlgorithm algorithm, com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod method, PublicKey publicKey)	Launch the flow with the JWT client authentication method.
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, com.nimbusds.jose.JWSAlgorithm algorithm)
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, com.nimbusds.jose.JWSAlgorithm algorithm, com.nimbusds.jose.JWSAlgorithm idTokenSigAlg, com.nimbusds.jose.JWEAlgorithm idTokenEncAlg, com.nimbusds.jose.EncryptionMethod idTokenEncMethod)
protected FlowExecutionResult	launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, com.nimbusds.jose.JWSAlgorithm algorithm, String requestedScope)
protected static FlowExecutionResult	launchWithJwtAuthentication(FlowExecutor flowExecutor, com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod, ExternalContext externalContext, MockHttpServletRequest request, String redirectUri, String scope, com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata metadata, String clientSecret, StorageService storageService)
private String	plainVerifier()
void	removeMetadata()
private String	s256Verifier()
void	testAuthTimeExpiredRefreshTokenGrant()
void	testChainExpiredRefreshTokenGrant()
void	testExpiredRefreshTokenGrant()
void	testInvalidGrant()
void	testInvalidSecretJWT()
void	testNoClientId()
void	testNoGrantType()
void	testNoScopesRegisteredWithOpenidScopeRequested()
void	testNoScopesRegisteredWithoutOpenidScopeRequestedNoResourcesInMetadata()
void	testNoScopesRegisteredWithoutOpenidScopeRequestedResourcesInMetadata()
void	testRevokedChainInRefreshTokenGrant()
void	testRevokedChainViaJtiInRefreshTokenGrant()
void	testRevokedRefreshTokenGrantRefreshTokenRotation()
void	testUnauthorizedGrant()
void	testUntrustedClient()
void	testValidGrant()
void	testValidGrantInvalidPlainPKCE()
void	testValidGrantInvalidS256PKCE()
void	testValidGrantInvalidUnforcedPlainPKCE()
void	testValidGrantInvalidUnforcedS256PKCE()
void	testValidGrantNonMatchingRedirectURI()
void	testValidGrantNoOpenId()
void	testValidGrantNoOpenIdRefreshTokensDisabledInSSOProfile()
void	testValidGrantNoOpenIdRefreshTokensDisabledInTokenProfile()
void	testValidGrantNoRedirectURIMultipleTrusted()
void	testValidGrantNoRedirectURISingleTrusted()
void	testValidGrantNoRedirectURISingleTrustedNotMatchingAuthzCode()
void	testValidGrantRefreshTokensDisabledInSSOProfile()
void	testValidGrantRefreshTokensDisabledInTokenProfile()
void	testValidGrantSaml()
void	testValidGrantValidPlainPKCE()
void	testValidGrantValidPlainPKCE_publicClient()
void	testValidGrantValidRequestMissingPlainPKCE()
void	testValidGrantValidRequestMissingS256PKCE()
void	testValidGrantValidS256PKCE()
void	testValidGrantValidS256PKCE_publicClient()
void	testValidGrantValidUnforcedPlainPKCE()
void	testValidGrantValidUnforcedPlainPKCE_publicClient()
void	testValidGrantValidUnforcedS256PKCE()
void	testValidGrantWithCustomTokens()
void	testValidGrantWithoutAuthentication()
void	testValidGrantWithRequestedScope()
void	testValidGrantWithSid()
void	testValidGrantWithWrongRegisteredAuthType()
void	testValidGrantWrappedClaims()
void	testValidGrantWrappedClaimsUI()
void	testValidLegacyConsentGrant()
void	testValidLegacyConsentRefreshTokenGrant()
void	testValidLegacyGrant()
void	testValidLegacyRefreshTokenGrant()
void	testValidRefreshTokenGrant()
void	testValidRefreshTokenGrant_idTokenIssuanceDisabled()
void	testValidRefreshTokenGrantRefreshTokenRotation()
void	testValidRefreshTokenGrantWithResource()
void	testValidRefreshTokenGrantWithSid()
void	testValidSecretJWT()
void	testValidSecretJWTNoAlg()
private AccessTokenClaimsSet	unwrapAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse tokenResponse)
protected void	validateConsentFromAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse response, boolean value)

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcClientAuthenticationFlowTest

buildPrivateKeyJwtAuth, buildPrivateKeyJwtAuth, buildSecretJwtAuth, buildSecretJwtAuth, buildSecretJwtAuth, claimsSetExpiredExp, claimsSetIssuedInTheFuture, claimsSetMissingAud, claimsSetMissingExp, claimsSetMissingIss, claimsSetMissingJti, claimsSetMissingSub, launchWithJwtAuthentication, populateClientAssertionParams, populateClientAssertionParams, setupRequestURI, testInvalidPrivateKeyESJWT_invalidSignerKey, testInvalidPrivateKeyESJWT_noTrustedKey, testInvalidPrivateKeyESJWT_wrongKey, testInvalidPrivateKeyJWT_expiredExp, testInvalidPrivateKeyJWT_issuedInTheFuture, testInvalidPrivateKeyJWT_missingAud, testInvalidPrivateKeyJWT_missingExp, testInvalidPrivateKeyJWT_missingIss, testInvalidPrivateKeyJWT_missingJti, testInvalidPrivateKeyJWT_missingSub, testInvalidPrivateKeyJWT_replayJti, testInvalidPrivateKeyJWTES256_algNotMatchingRegistered, testInvalidPrivateKeyJWTES384_algNotMatchingRegistered, testInvalidPrivateKeyJWTES512_algNotMatchingRegistered, testInvalidPrivateKeyJWTRS256_algNotMatchingRegistered, testInvalidPrivateKeyJWTRS384_algNotMatchingRegistered, testInvalidPrivateKeyJWTRS512_algNotMatchingRegistered, testInvalidPrivateKeyRSJWT_invalidSignerKey, testInvalidPrivateKeyRSJWT_noTrustedKey, testInvalidPrivateKeyRSJWT_wrongKey, testInvalidSecretJWT_expiredExp, testInvalidSecretJWT_invalidSecret, testInvalidSecretJWT_issuedInTheFuture, testInvalidSecretJWT_missingAud, testInvalidSecretJWT_missingExp, testInvalidSecretJWT_missingIss, testInvalidSecretJWT_missingJti, testInvalidSecretJWT_missingSub, testInvalidSecretJWT_replayJti, testInvalidSecretJWTHS256_algNotMatchingRegistered, testInvalidSecretJWTHS384_algNotMatchingRegistered, testInvalidSecretJWTHS512_algNotMatchingRegistered, testPlainJWT, testValidPrivateKeyJWTES256_ES256Registered, testValidPrivateKeyJWTES256_noRegisteredAlg, testValidPrivateKeyJWTES384_ES384Registered, testValidPrivateKeyJWTES384_noRegisteredAlg, testValidPrivateKeyJWTES512_ES512Registered, testValidPrivateKeyJWTES512_noRegisteredAlg, testValidPrivateKeyJWTRS256_noRegisteredAlg, testValidPrivateKeyJWTRS256_RS256Registered, testValidPrivateKeyJWTRS384_noRegisteredAlg, testValidPrivateKeyJWTRS384_RS384Registered, testValidPrivateKeyJWTRS512_noRegisteredAlg, testValidPrivateKeyJWTRS512_RS512Registered, testValidSecretJWTH384_noRegisteredAlg, testValidSecretJWTHS256_HS256Registered, testValidSecretJWTHS256_IssuerAudience, testValidSecretJWTHS256_noRegisteredAlg, testValidSecretJWTHS256_TokenEndpointAudience, testValidSecretJWTHS384_HS384Registered, testValidSecretJWTHS512_HS512Registered, testValidSecretJWTHS512_noRegisteredAlg, validClaimsSet, validClaimsSet

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcApiFlowTest

buildJWTToken, buildJWTToken, buildLegacyToken, buildLegacyToken, buildRefreshToken, buildRefreshToken

Methods inherited from class net.shibboleth.idp.plugin.oidc.op.profile.flow.AbstractOidcFlowTest

assertErrorCode, assertErrorDescriptionContains, buildJsonForLegacyToken, buildJWKSet, buildMetadataSkeleton, buildToken, buildToken, buildToken, createEncryptedJWT, createEncryptedJWT, createEncryptedJWT, createPrivateKeyJWT, createPrivateKeyJWT, createPrivateKeyJWT, createSecretJWT, createSecretJWT, generateNewKeyPair, generateNewKeyPair, getDataSealer, initializeECKey, initializeMocks, initializeThreadLocals, initKeys, loadCredential, loadEncryptionCredential, loadES384SigningCredential, loadES512SigningCredential, loadESSigningCredential, loadRSSigningCredential, parseErrorResponse, parseResponse, parseSuccessResponse, removeMetadata, setBasicAuth, setHttpFormRequest, setHttpFormRequest, setJsonRequest, setRequest, setRequest, storeConsent, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadata, storeMetadataObject

Methods inherited from class net.shibboleth.idp.test.flows.AbstractFlowTest

assertFlowExecutionOutcome, assertFlowExecutionOutcome, assertFlowExecutionResult, assertProfileRequestContext, buildSOAP11Envelope, clearThreadLocals, getFlow, initializeFlowExecutor, initializeXMLObjectSupport, overrideEndStateOutput, overrideEndStateOutput, registerFlowsInParentRegistry, retrieveProfileRequestContext, setupDirectoryServer, teardownDirectoryServer

Methods inherited from class org.springframework.test.context.testng.AbstractTestNGSpringContextTests

run, setApplicationContext, springTestContextAfterTestClass, springTestContextAfterTestMethod, springTestContextBeforeTestClass, springTestContextBeforeTestMethod, springTestContextPrepareTestInstance

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

FLOW_ID

public static final String FLOW_ID

See Also:

Constant Field Values

redirectUri

String redirectUri

clientIdPkcePlain

String clientIdPkcePlain

clientIdPkcePlainUnforced

String clientIdPkcePlainUnforced

clientIdPkceS256

String clientIdPkceS256

clientIdPkcePlainPublic

String clientIdPkcePlainPublic

clientIdPkcePlainUnforcedPublic

String clientIdPkcePlainUnforcedPublic

clientIdPkceS256Public

String clientIdPkceS256Public

clientIdCustomTokens

String clientIdCustomTokens

clientIdRefreshTokenRotation

String clientIdRefreshTokenRotation

clientIdJwtAccessToken

String clientIdJwtAccessToken

clientIdNoIdTokenViaRefreshToken

String clientIdNoIdTokenViaRefreshToken

codeVerifier

String codeVerifier

scope

com.nimbusds.oauth2.sdk.Scope scope

storageService

@Autowired
@Qualifier("shibboleth.StorageService")
StorageService storageService

revocationCache

@Autowired
@Qualifier("shibboleth.oidc.RevocationCache")
RevocationCache revocationCache

Constructor Detail

TokenFlowTest

public TokenFlowTest()

Method Detail

removeMetadata

@AfterMethod
public void removeMetadata()
                    throws IOException

Throws:

IOException

testNoClientId

public void testNoClientId()
                    throws IOException,
                           ParseException

Throws:

IOException

ParseException

testNoGrantType

public void testNoGrantType()
                     throws IOException,
                            ParseException

Throws:

IOException

ParseException

testUntrustedClient

public void testUntrustedClient()
                         throws IOException,
                                ParseException

Throws:

IOException

ParseException

testUnauthorizedGrant

public void testUnauthorizedGrant()
                           throws IOException,
                                  ParseException

Throws:

IOException

ParseException

testInvalidGrant

public void testInvalidGrant()
                      throws ParseException,
                             IOException

Throws:

ParseException

IOException

testNoScopesRegisteredWithOpenidScopeRequested

public void testNoScopesRegisteredWithOpenidScopeRequested()
                                                    throws Exception

Throws:

Exception

testNoScopesRegisteredWithoutOpenidScopeRequestedResourcesInMetadata

public void testNoScopesRegisteredWithoutOpenidScopeRequestedResourcesInMetadata()
                                                                          throws Exception

Throws:

Exception

testNoScopesRegisteredWithoutOpenidScopeRequestedNoResourcesInMetadata

public void testNoScopesRegisteredWithoutOpenidScopeRequestedNoResourcesInMetadata()
                                                                            throws Exception

Throws:

Exception

initializeGrantAndRequest

protected void initializeGrantAndRequest(String clientId,
                                         Map<String,String> requestParameters)
                                  throws IOException

Throws:

IOException

initializeGrantAndRequest

protected void initializeGrantAndRequest(String clientId,
                                         Map<String,String> requestParameters,
                                         boolean doBasicAuth,
                                         com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod registeredMethod)
                                  throws IOException

Throws:

IOException

testValidGrant

public void testValidGrant()
                    throws Exception

Throws:

Exception

testValidGrantNoOpenId

public void testValidGrantNoOpenId()
                            throws Exception

Throws:

Exception

testValidGrantNoOpenIdRefreshTokensDisabledInSSOProfile

public void testValidGrantNoOpenIdRefreshTokensDisabledInSSOProfile()
                                                             throws Exception

Throws:

Exception

testValidGrantNoOpenIdRefreshTokensDisabledInTokenProfile

public void testValidGrantNoOpenIdRefreshTokensDisabledInTokenProfile()
                                                               throws Exception

Throws:

Exception

testValidGrantWithSid

public void testValidGrantWithSid()
                           throws Exception

Throws:

Exception

testValidGrantNonMatchingRedirectURI

public void testValidGrantNonMatchingRedirectURI()
                                          throws Exception

Throws:

Exception

testValidGrantNoRedirectURISingleTrusted

public void testValidGrantNoRedirectURISingleTrusted()
                                              throws Exception

Throws:

Exception

testValidGrantNoRedirectURISingleTrustedNotMatchingAuthzCode

public void testValidGrantNoRedirectURISingleTrustedNotMatchingAuthzCode()
                                                                  throws Exception

Throws:

Exception

testValidGrantNoRedirectURIMultipleTrusted

public void testValidGrantNoRedirectURIMultipleTrusted()
                                                throws Exception

Throws:

Exception

testValidGrantWithCustomTokens

public void testValidGrantWithCustomTokens()
                                    throws Exception

Throws:

Exception

testValidGrantWithWrongRegisteredAuthType

public void testValidGrantWithWrongRegisteredAuthType()
                                               throws Exception

Throws:

Exception

testValidGrantWithoutAuthentication

public void testValidGrantWithoutAuthentication()
                                         throws Exception

Throws:

Exception

testValidGrantRefreshTokensDisabledInSSOProfile

public void testValidGrantRefreshTokensDisabledInSSOProfile()
                                                     throws Exception

Throws:

Exception

testValidGrantRefreshTokensDisabledInTokenProfile

public void testValidGrantRefreshTokensDisabledInTokenProfile()
                                                       throws Exception

Throws:

Exception

testValidGrantWithRequestedScope

public void testValidGrantWithRequestedScope()
                                      throws Exception

Throws:

Exception

testValidLegacyGrant

public void testValidLegacyGrant()
                          throws Exception

Throws:

Exception

testValidLegacyConsentGrant

public void testValidLegacyConsentGrant()
                                 throws Exception

Throws:

Exception

validateConsentFromAccessToken

protected void validateConsentFromAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse response,
                                              boolean value)
                                       throws Exception

Throws:

Exception

testValidGrantSaml

public void testValidGrantSaml()
                        throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId)
                                 throws Exception

Throws:

Exception

buildAuthorizationCodeWithSid

protected String buildAuthorizationCodeWithSid(String clientId,
                                               String sid)
                                        throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId,
                                        String verifier)
                                 throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId,
                                        String verifier,
                                        String scope)
                                 throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId,
                                        String verifier,
                                        net.minidev.json.JSONObject deliveryClaims,
                                        net.minidev.json.JSONObject deliveryClaimsIDToken,
                                        net.minidev.json.JSONObject deliveryClaimsUserInfo)
                                 throws Exception

Throws:

Exception

buildAuthorizationCode

protected String buildAuthorizationCode(String clientId,
                                        String verifier,
                                        net.minidev.json.JSONObject deliveryClaims,
                                        net.minidev.json.JSONObject deliveryClaimsIDToken,
                                        net.minidev.json.JSONObject deliveryClaimsUserInfo,
                                        String scope)
                                 throws Exception

Throws:

Exception

buildAuthorizationCodeWithSid

protected String buildAuthorizationCodeWithSid(String clientId,
                                               String verifier,
                                               net.minidev.json.JSONObject deliveryClaims,
                                               net.minidev.json.JSONObject deliveryClaimsIDToken,
                                               net.minidev.json.JSONObject deliveryClaimsUserInfo,
                                               String scope,
                                               String sid)
                                        throws Exception

Throws:

Exception

buildLegacyAuthorizationCode

protected String buildLegacyAuthorizationCode(String clientId,
                                              String... consentedClaims)
                                       throws Exception

Throws:

Exception

buildLegacyRefreshToken

protected String buildLegacyRefreshToken(String clientId,
                                         String... consentedClaims)
                                  throws Exception

Throws:

Exception

buildDefaultClaimsSet

protected TokenClaimsSet buildDefaultClaimsSet(String clientId,
                                               Collection<String> aud)
                                        throws Exception

Throws:

Exception

buildDefaultClaimsSet

protected TokenClaimsSet buildDefaultClaimsSet(String clientId,
                                               Collection<String> aud,
                                               Instant authTime)
                                        throws Exception

Throws:

Exception

buildRefreshToken

protected String buildRefreshToken(String clientId,
                                   String id,
                                   String rootId,
                                   Collection<String> aud,
                                   String... consentedClaims)
                            throws Exception

Throws:

Exception

buildRefreshToken

protected String buildRefreshToken(String clientId,
                                   String id,
                                   String rootId,
                                   Collection<String> aud,
                                   Instant authTime,
                                   Instant chainExp,
                                   String... consentedClaims)
                            throws Exception

Throws:

Exception

buildRefreshToken

protected String buildRefreshToken(String clientId,
                                   String id,
                                   String rootId,
                                   Collection<String> aud,
                                   Instant authTime,
                                   Instant chainExp,
                                   Instant tokenExp,
                                   String... consentedClaims)
                            throws Exception

Throws:

Exception

buildRefreshTokenWithSid

protected String buildRefreshTokenWithSid(String clientId,
                                          String id,
                                          String rootId,
                                          Collection<String> aud,
                                          String sid,
                                          String... consentedClaims)
                                   throws Exception

Throws:

Exception

testValidSecretJWT

public void testValidSecretJWT()
                        throws Exception

Throws:

Exception

testValidSecretJWTNoAlg

public void testValidSecretJWTNoAlg()
                             throws Exception

Throws:

Exception

testValidGrantValidRequestMissingPlainPKCE

public void testValidGrantValidRequestMissingPlainPKCE()
                                                throws Exception

Throws:

Exception

testValidGrantInvalidUnforcedPlainPKCE

public void testValidGrantInvalidUnforcedPlainPKCE()
                                            throws Exception

Throws:

Exception

testValidGrantInvalidPlainPKCE

public void testValidGrantInvalidPlainPKCE()
                                    throws Exception

Throws:

Exception

testValidGrantValidPlainPKCE

public void testValidGrantValidPlainPKCE()
                                  throws Exception

Throws:

Exception

testValidGrantValidPlainPKCE_publicClient

public void testValidGrantValidPlainPKCE_publicClient()
                                               throws Exception

Throws:

Exception

testValidGrantValidUnforcedPlainPKCE

public void testValidGrantValidUnforcedPlainPKCE()
                                          throws Exception

Throws:

Exception

testValidGrantValidUnforcedPlainPKCE_publicClient

public void testValidGrantValidUnforcedPlainPKCE_publicClient()
                                                       throws Exception

Throws:

Exception

testValidGrantValidRequestMissingS256PKCE

public void testValidGrantValidRequestMissingS256PKCE()
                                               throws Exception

Throws:

Exception

testValidGrantInvalidUnforcedS256PKCE

public void testValidGrantInvalidUnforcedS256PKCE()
                                           throws Exception

Throws:

Exception

testValidGrantInvalidS256PKCE

public void testValidGrantInvalidS256PKCE()
                                   throws Exception

Throws:

Exception

testValidGrantValidS256PKCE

public void testValidGrantValidS256PKCE()
                                 throws Exception

Throws:

Exception

testValidGrantValidS256PKCE_publicClient

public void testValidGrantValidS256PKCE_publicClient()
                                              throws Exception

Throws:

Exception

testValidGrantValidUnforcedS256PKCE

public void testValidGrantValidUnforcedS256PKCE()
                                         throws Exception

Throws:

Exception

testInvalidSecretJWT

public void testInvalidSecretJWT()
                          throws Exception

Throws:

Exception

testValidGrantWrappedClaimsUI

public void testValidGrantWrappedClaimsUI()
                                   throws Exception

Throws:

Exception

testValidGrantWrappedClaims

public void testValidGrantWrappedClaims()
                                 throws Exception

Throws:

Exception

testValidLegacyRefreshTokenGrant

public void testValidLegacyRefreshTokenGrant()
                                      throws Exception

Throws:

Exception

testValidLegacyConsentRefreshTokenGrant

public void testValidLegacyConsentRefreshTokenGrant()
                                             throws Exception

Throws:

Exception

testValidRefreshTokenGrant

public void testValidRefreshTokenGrant()
                                throws Exception

Throws:

Exception

testChainExpiredRefreshTokenGrant

public void testChainExpiredRefreshTokenGrant()
                                       throws Exception

Throws:

Exception

testAuthTimeExpiredRefreshTokenGrant

public void testAuthTimeExpiredRefreshTokenGrant()
                                          throws Exception

Throws:

Exception

testExpiredRefreshTokenGrant

public void testExpiredRefreshTokenGrant()
                                  throws Exception

Throws:

Exception

testValidRefreshTokenGrant_idTokenIssuanceDisabled

public void testValidRefreshTokenGrant_idTokenIssuanceDisabled()
                                                        throws Exception

Throws:

Exception

testValidRefreshTokenGrantWithSid

public void testValidRefreshTokenGrantWithSid()
                                       throws Exception

Throws:

Exception

testValidRefreshTokenGrantWithResource

public void testValidRefreshTokenGrantWithResource()
                                            throws Exception

Throws:

Exception

testValidRefreshTokenGrantRefreshTokenRotation

public void testValidRefreshTokenGrantRefreshTokenRotation()
                                                    throws Exception

Throws:

Exception

testRevokedRefreshTokenGrantRefreshTokenRotation

public void testRevokedRefreshTokenGrantRefreshTokenRotation()
                                                      throws Exception

Throws:

Exception

testRevokedChainInRefreshTokenGrant

public void testRevokedChainInRefreshTokenGrant()
                                         throws Exception

Throws:

Exception

testRevokedChainViaJtiInRefreshTokenGrant

public void testRevokedChainViaJtiInRefreshTokenGrant()
                                               throws Exception

Throws:

Exception

createIdTokenSecurityTests

@Factory
public Object[] createIdTokenSecurityTests()

createAccessTokenSecurityTests

@Factory
public Object[] createAccessTokenSecurityTests()

unwrapAccessToken

private AccessTokenClaimsSet unwrapAccessToken(com.nimbusds.openid.connect.sdk.OIDCTokenResponse tokenResponse)

plainVerifier

private String plainVerifier()

s256Verifier

private String s256Verifier()

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm)
                                                   throws Exception

Throws:

Exception

buildAuthorizationCode

protected static String buildAuthorizationCode(String clientId,
                                               String issuer,
                                               String userPrincipal,
                                               String sub,
                                               String callbackUrl,
                                               String scope,
                                               Collection<String> aud)
                                        throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm,
                                                          String requestedScope)
                                                   throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm,
                                                          com.nimbusds.jose.JWSAlgorithm idTokenSigAlg,
                                                          com.nimbusds.jose.JWEAlgorithm idTokenEncAlg,
                                                          com.nimbusds.jose.EncryptionMethod idTokenEncMethod)
                                                   throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected static FlowExecutionResult launchWithJwtAuthentication(FlowExecutor flowExecutor,
                                                                 com.nimbusds.oauth2.sdk.auth.JWTAuthentication authnMethod,
                                                                 ExternalContext externalContext,
                                                                 MockHttpServletRequest request,
                                                                 String redirectUri,
                                                                 String scope,
                                                                 com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata metadata,
                                                                 String clientSecret,
                                                                 StorageService storageService)
                                                          throws Exception

Throws:

Exception

launchWithJwtAuthentication

protected FlowExecutionResult launchWithJwtAuthentication(com.nimbusds.jwt.JWT jwt,
                                                          com.nimbusds.jose.JWSAlgorithm algorithm,
                                                          com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod method,
                                                          PublicKey publicKey)
                                                   throws Exception

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Launch the flow with the JWT client authentication method.

Specified by:

launchWithJwtAuthentication in class AbstractOidcClientAuthenticationFlowTest

Parameters:

jwt - The JWT to be used for client authentication.

algorithm - The algorithm to be used in the client authentication.

method - The client authentication method.

publicKey - The public key to store into the trusted metadata.

Returns:

The flow execution result.

Throws:

Exception

createRequestParameters

protected static Map<String,String> createRequestParameters(String redirectUri,
                                                                  String grantType,
                                                                  String code,
                                                                  String clientId)

createRequestParameters

protected static Map<String,String> createRequestParameters(String redirectUri,
                                                                  String grantType,
                                                                  String code,
                                                                  String clientId,
                                                                  String codeChallenge,
                                                                  String codeChallengeMethod,
                                                                  String codeVerifier)

addNonNullValue

private static void addNonNullValue(Map<String,String> map,
                                    String key,
                                    String value)

getErrorDetaisForJWTValidation

protected Pair<String,String> getErrorDetaisForJWTValidation()

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Get the pair of error code and error description for the error produced via event EventIds.ACCESS_DENIED. This is abstract due to the fact that each endpoint may have its own mappings.

Specified by:

getErrorDetaisForJWTValidation in class AbstractOidcClientAuthenticationFlowTest

Returns:

The pair of error code and error description.

assertSuccessResponse

protected void assertSuccessResponse(FlowExecutionResult result)

Description copied from class: AbstractOidcClientAuthenticationFlowTest

Verify that the given result is a success response.

Specified by:

assertSuccessResponse in class AbstractOidcClientAuthenticationFlowTest

Parameters:

result - The flow execution result to be verified.

getSidFromAccessToken

protected String getSidFromAccessToken(com.nimbusds.oauth2.sdk.token.AccessToken accessToken)

getSidFromRefreshToken

protected String getSidFromRefreshToken(com.nimbusds.oauth2.sdk.token.RefreshToken refreshToken)

getSidFromJWT

protected String getSidFromJWT(com.nimbusds.jwt.JWT jwt)