You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2017/07/10 10:49:26 UTC
[2/2] cxf-fediz git commit: Adding roles tests
Adding roles tests
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/6392d4f7
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/6392d4f7
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/6392d4f7
Branch: refs/heads/master
Commit: 6392d4f7574cbb9a9b72b895c6001d5c19a347b6
Parents: 3070c4c
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Jul 10 11:48:47 2017 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Jul 10 11:48:47 2017 +0100
----------------------------------------------------------------------
.../cxf/fediz/systests/oidc/OIDCTest.java | 53 ++++++++++++++++++++
.../src/test/resources/oidc/data-manager.xml | 13 ++++-
2 files changed, 64 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/6392d4f7/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
----------------------------------------------------------------------
diff --git a/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java b/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
index 241e1b6..56014d9 100644
--- a/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
+++ b/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java
@@ -35,6 +35,7 @@ import java.security.cert.X509Certificate;
import java.text.SimpleDateFormat;
import java.util.ArrayList;
import java.util.Date;
+import java.util.List;
import java.util.Locale;
import java.util.TimeZone;
@@ -897,6 +898,45 @@ public class OIDCTest {
webClient.close();
}
+ @org.junit.Test
+ public void testOIDCLoginForClient1WithRoles() throws Exception {
+
+ String url = "https://localhost:" + getRpHttpsPort() + "/fediz-oidc/idp/authorize?";
+ url += "client_id=" + storedClientId;
+ url += "&response_type=code";
+ url += "&scope=openid";
+ url += "&claims=roles";
+ String user = "alice";
+ String password = "ecila";
+
+ // Login to the OIDC token endpoint + get the authorization code
+ WebClient webClient = setupWebClient(user, password, getIdpHttpsPort());
+ String authorizationCode = loginAndGetAuthorizationCode(url, webClient);
+ Assert.assertNotNull(authorizationCode);
+
+ // Now use the code to get an IdToken
+
+ url = "https://localhost:" + getRpHttpsPort() + "/fediz-oidc/oauth2/token";
+ WebRequest request = new WebRequest(new URL(url), HttpMethod.POST);
+
+ request.setRequestParameters(new ArrayList<NameValuePair>());
+ request.getRequestParameters().add(new NameValuePair("client_id", storedClientId));
+ request.getRequestParameters().add(new NameValuePair("grant_type", "authorization_code"));
+ request.getRequestParameters().add(new NameValuePair("code", authorizationCode));
+
+ webClient.getOptions().setJavaScriptEnabled(false);
+ final UnexpectedPage responsePage = webClient.getPage(request);
+ String response = responsePage.getWebResponse().getContentAsString();
+
+ // Check the IdToken
+ String idToken = getIdToken(response);
+ Assert.assertNotNull(idToken);
+ validateIdToken(idToken, storedClientId, "User");
+
+ webClient.close();
+ }
+
+
private static WebClient setupWebClient(String user, String password, String idpPort) {
final WebClient webClient = new WebClient();
webClient.getOptions().setUseInsecureSSL(true);
@@ -984,6 +1024,11 @@ public class OIDCTest {
private void validateIdToken(String idToken, String audience)
throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
+ validateIdToken(idToken, audience, null);
+ }
+
+ private void validateIdToken(String idToken, String audience, String role)
+ throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idToken);
JwtToken jwt = jwtConsumer.getJwtToken();
@@ -994,6 +1039,14 @@ public class OIDCTest {
Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_EXPIRY));
Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_ISSUED_AT));
+ // Check role
+ if (role != null) {
+ List<?> roles = (List<?>)jwt.getClaim("roles");
+ Assert.assertNotNull(roles);
+ Assert.assertFalse(roles.isEmpty());
+ Assert.assertEquals(role, roles.get(0));
+ }
+
KeyStore keystore = KeyStore.getInstance("JKS");
keystore.load(Loader.getResource("oidc.jks").openStream(), "password".toCharArray());
Certificate cert = keystore.getCertificate("alice");
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/6392d4f7/systests/oidc/src/test/resources/oidc/data-manager.xml
----------------------------------------------------------------------
diff --git a/systests/oidc/src/test/resources/oidc/data-manager.xml b/systests/oidc/src/test/resources/oidc/data-manager.xml
index a5c2c56..7c2b7dc 100644
--- a/systests/oidc/src/test/resources/oidc/data-manager.xml
+++ b/systests/oidc/src/test/resources/oidc/data-manager.xml
@@ -34,7 +34,14 @@
<entry key="openid" value="Access the authentication claims" />
<entry key="refreshToken" value="Refresh access tokens" />
</util:map>
-
+
+ <!-- Additional Fediz Authentication properties which can be mapped to
+ IdToken claims if such claims are requested by the clients with the 'claims' parameter
+ -->
+ <util:map id="supportedClaims">
+ <entry key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role" value="roles" />
+ </util:map>
+
<!--
List of required scopes that must be available in request URIs when
client redirects users to OIDC
@@ -50,7 +57,7 @@
<util:list id="invisibleToClientScopes">
<value>refreshToken</value>
</util:list>
-
+
<!--
To support the alternative data persistence strategies: either register a custom
AbstractCodeDataProvider extension or implement AuthorizationCodeDataProvider directly
@@ -85,6 +92,8 @@
<!-- Custom SubjectCreator where IdToken is created -->
<bean id="subjectCreator" class="org.apache.cxf.fediz.service.oidc.FedizSubjectCreator">
<property name="idTokenIssuer" value="accounts.fediz.com"/>
+ <!-- List of additional claims which can be optionally added to IdToken -->
+ <property name="supportedClaims" ref="supportedClaims"/>
</bean>
</beans>