Adding roles tests
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/6392d4f7 Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/6392d4f7 Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/6392d4f7 Branch: refs/heads/master Commit: 6392d4f7574cbb9a9b72b895c6001d5c19a347b6 Parents: 3070c4c Author: Colm O hEigeartaigh <[email protected]> Authored: Mon Jul 10 11:48:47 2017 +0100 Committer: Colm O hEigeartaigh <[email protected]> Committed: Mon Jul 10 11:48:47 2017 +0100 ---------------------------------------------------------------------- .../cxf/fediz/systests/oidc/OIDCTest.java | 53 ++++++++++++++++++++ .../src/test/resources/oidc/data-manager.xml | 13 ++++- 2 files changed, 64 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/6392d4f7/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java ---------------------------------------------------------------------- diff --git a/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java b/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java index 241e1b6..56014d9 100644 --- a/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java +++ b/systests/oidc/src/test/java/org/apache/cxf/fediz/systests/oidc/OIDCTest.java @@ -35,6 +35,7 @@ import java.security.cert.X509Certificate; import java.text.SimpleDateFormat; import java.util.ArrayList; import java.util.Date; +import java.util.List; import java.util.Locale; import java.util.TimeZone; @@ -897,6 +898,45 @@ public class OIDCTest { webClient.close(); } + @org.junit.Test + public void testOIDCLoginForClient1WithRoles() throws Exception { + + String url = "https://localhost:"; + getRpHttpsPort() + "/fediz-oidc/idp/authorize?"; + url += "client_id=" + storedClientId; + url += "&response_type=code"; + url += "&scope=openid"; + url += "&claims=roles"; + String user = "alice"; + String password = "ecila"; + + // Login to the OIDC token endpoint + get the authorization code + WebClient webClient = setupWebClient(user, password, getIdpHttpsPort()); + String authorizationCode = loginAndGetAuthorizationCode(url, webClient); + Assert.assertNotNull(authorizationCode); + + // Now use the code to get an IdToken + + url = "https://localhost:"; + getRpHttpsPort() + "/fediz-oidc/oauth2/token"; + WebRequest request = new WebRequest(new URL(url), HttpMethod.POST); + + request.setRequestParameters(new ArrayList<NameValuePair>()); + request.getRequestParameters().add(new NameValuePair("client_id", storedClientId)); + request.getRequestParameters().add(new NameValuePair("grant_type", "authorization_code")); + request.getRequestParameters().add(new NameValuePair("code", authorizationCode)); + + webClient.getOptions().setJavaScriptEnabled(false); + final UnexpectedPage responsePage = webClient.getPage(request); + String response = responsePage.getWebResponse().getContentAsString(); + + // Check the IdToken + String idToken = getIdToken(response); + Assert.assertNotNull(idToken); + validateIdToken(idToken, storedClientId, "User"); + + webClient.close(); + } + + private static WebClient setupWebClient(String user, String password, String idpPort) { final WebClient webClient = new WebClient(); webClient.getOptions().setUseInsecureSSL(true); @@ -984,6 +1024,11 @@ public class OIDCTest { private void validateIdToken(String idToken, String audience) throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException { + validateIdToken(idToken, audience, null); + } + + private void validateIdToken(String idToken, String audience, String role) + throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException { JwsJwtCompactConsumer jwtConsumer = new JwsJwtCompactConsumer(idToken); JwtToken jwt = jwtConsumer.getJwtToken(); @@ -994,6 +1039,14 @@ public class OIDCTest { Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_EXPIRY)); Assert.assertNotNull(jwt.getClaim(JwtConstants.CLAIM_ISSUED_AT)); + // Check role + if (role != null) { + List<?> roles = (List<?>)jwt.getClaim("roles"); + Assert.assertNotNull(roles); + Assert.assertFalse(roles.isEmpty()); + Assert.assertEquals(role, roles.get(0)); + } + KeyStore keystore = KeyStore.getInstance("JKS"); keystore.load(Loader.getResource("oidc.jks").openStream(), "password".toCharArray()); Certificate cert = keystore.getCertificate("alice"); http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/6392d4f7/systests/oidc/src/test/resources/oidc/data-manager.xml ---------------------------------------------------------------------- diff --git a/systests/oidc/src/test/resources/oidc/data-manager.xml b/systests/oidc/src/test/resources/oidc/data-manager.xml index a5c2c56..7c2b7dc 100644 --- a/systests/oidc/src/test/resources/oidc/data-manager.xml +++ b/systests/oidc/src/test/resources/oidc/data-manager.xml @@ -34,7 +34,14 @@ <entry key="openid" value="Access the authentication claims" /> <entry key="refreshToken" value="Refresh access tokens" /> </util:map> - + + <!-- Additional Fediz Authentication properties which can be mapped to + IdToken claims if such claims are requested by the clients with the 'claims' parameter + --> + <util:map id="supportedClaims"> + <entry key="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/role"; value="roles" /> + </util:map> + <!-- List of required scopes that must be available in request URIs when client redirects users to OIDC @@ -50,7 +57,7 @@ <util:list id="invisibleToClientScopes"> <value>refreshToken</value> </util:list> - + <!-- To support the alternative data persistence strategies: either register a custom AbstractCodeDataProvider extension or implement AuthorizationCodeDataProvider directly @@ -85,6 +92,8 @@ <!-- Custom SubjectCreator where IdToken is created --> <bean id="subjectCreator" class="org.apache.cxf.fediz.service.oidc.FedizSubjectCreator"> <property name="idTokenIssuer" value="accounts.fediz.com"/> + <!-- List of additional claims which can be optionally added to IdToken --> + <property name="supportedClaims" ref="supportedClaims"/> </bean> </beans>
