evolution, not revolution

jalauros · jalauros · commit 92ba79434050 · 2018-07-18T15:31:37.000+03:00
diff --git a/src/main/java/org/oidc/msg/AuthenticationRequest.java b/src/main/java/org/oidc/msg/AuthenticationRequest.java
@@ -1,10 +1,13 @@
 package org.oidc.msg;
 
+import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
 import java.util.regex.Pattern;
 
+import org.oidc.msg.oidc.IDToken;
+
 /**
  * Authentication request message as described in
  * http://openid.net/specs/openid-connect-core-1_0.html.
@@ -80,11 +83,25 @@ public boolean verify() throws InvalidClaimException {
     // Create OpenIDRequest message class, decode it from JWT. It should check the signature
     // Check that fields match -> ValueError
     
-    // TODO: TASK3
-    // Verify "id_token_hint" if it exists..
-    // Use IdToken, decode it from JWT. It should check the signature
+    // TODO: verify from Rolands code the case ''Nonce in id_token not matching nonce in authz'
     
-    // TODO: verify from Rolands code the case ''Nonce in id_token not matching nonce in authz'..what is a
+    String idTokenHint = ((String) getClaims().get("id_token_hint"));
+    if (idTokenHint != null) {
+      IDToken idToken = new IDToken();
+      try {
+        idToken.fromJwt(idTokenHint);
+      } catch (IOException e) {
+        getError().getMessages()
+            .add(String.format("Unable to from id token from '%s'", idTokenHint));
+      }
+      try {
+        idToken.verify();
+      } catch (InvalidClaimException e) {
+        for (String errorDesc : idToken.getError().getMessages()) {
+          getError().getMessages().add(String.format("id_token_hint failed: '%s'", errorDesc));
+        }
+      }
+    }
     
     String spaceSeparatedScopes = ((String) getClaims().get("scope"));
     if (spaceSeparatedScopes == null
diff --git a/src/test/java/org/oidc/msg/AuthenticationRequestTest.java b/src/test/java/org/oidc/msg/AuthenticationRequestTest.java
@@ -13,7 +13,7 @@ public class AuthenticationRequestTest {
   Map<String, Object> claims = new HashMap<String, Object>();
 
   /**
-   * Setuo mandatory claims.
+   * Setup mandatory claims.
    */
   @Before
   public void setup() {
@@ -51,7 +51,7 @@ public void testSuccessOfflineAccess() throws InvalidClaimException {
     Assert.assertEquals("consent", ((List<String>) req.getClaims().get("prompt")).get(0));
     Assert.assertEquals("openid offline_access", req.getClaims().get("scope"));
   }
-  
+
   @Test
   public void testSuccessResponseTypeIdToken() throws InvalidClaimException {
     claims.put("response_type", "id_token token");
@@ -61,7 +61,7 @@ public void testSuccessResponseTypeIdToken() throws InvalidClaimException {
     Assert.assertEquals("DFHGFG", (String) req.getClaims().get("nonce"));
     Assert.assertEquals("id_token token", req.getClaims().get("response_type"));
   }
-  
+
   @Test(expected = InvalidClaimException.class)
   public void testFailResponseTypeIdTokenMissingNonce() throws InvalidClaimException {
     claims.put("response_type", "id_token token");
@@ -108,4 +108,39 @@ public void testFailUnAllowedDisplayValue() throws InvalidClaimException {
     req.verify();
   }
 
+  @Test
+  public void testSuccessIdTokenHint() throws InvalidClaimException {
+    // TODO: There is no capability in is token to verify signature nor timestamps or sorts yet.
+    // Once there is, this test will fail and needs to be updated to produce id token that passes
+    // validation.
+    String idToken = "eyJraWQiOiIxZTlnZGs3IiwiYWxnIjoiUlMyNTYifQ.ewogImlz"
+        + "cyI6ICJodHRwOi8vc2VydmVyLmV4YW1wbGUuY29tIiwKICJzdWIiOiAiMjQ4"
+        + "Mjg5NzYxMDAxIiwKICJhdWQiOiAiczZCaGRSa3F0MyIsCiAibm9uY2UiOiAi"
+        + "bi0wUzZfV3pBMk1qIiwKICJleHAiOiAxMzExMjgxOTcwLAogImlhdCI6IDEz"
+        + "MTEyODA5NzAsCiAibmFtZSI6ICJKYW5lIERvZSIsCiAiZ2l2ZW5fbmFtZSI6"
+        + "ICJKYW5lIiwKICJmYW1pbHlfbmFtZSI6ICJEb2UiLAogImdlbmRlciI6ICJm"
+        + "ZW1hbGUiLAogImJpcnRoZGF0ZSI6ICIwMDAwLTEwLTMxIiwKICJlbWFpbCI6"
+        + "ICJqYW5lZG9lQGV4YW1wbGUuY29tIiwKICJwaWN0dXJlIjogImh0dHA6Ly9l"
+        + "eGFtcGxlLmNvbS9qYW5lZG9lL21lLmpwZyIKfQ.rHQjEmBqn9Jre0OLykYNn"
+        + "spA10Qql2rvx4FsD00jwlB0Sym4NzpgvPKsDjn_wMkHxcp6CilPcoKrWHcip"
+        + "R2iAjzLvDNAReF97zoJqq880ZD1bwY82JDauCXELVR9O6_B0w3K-E7yM2mac"
+        + "AAgNCUwtik6SjoSUZRcf-O5lygIyLENx882p6MtmwaL1hd6qn5RZOQ0TLrOY"
+        + "u0532g9Exxcm-ChymrB4xLykpDj3lUivJt63eEGGN6DH5K6o33TcxkIjNrCD"
+        + "4XB1CKKumZvCedgHHF3IAK4dVEDSUoGlH9z4pP_eWYNXvqQOjGs-rDaQzUHl" 
+        + "6cQQWNiDpWOl_lxXjQEvQ";
+    claims.put("id_token_hint", idToken);
+    AuthenticationRequest req = new AuthenticationRequest(claims);
+    req.verify();
+    Assert.assertEquals(idToken, req.getClaims().get("id_token_hint"));
+  }
+
+  @Test(expected = Exception.class)
+  public void testFailIdTokenHintInvalid() throws InvalidClaimException {
+    String idToken = "notparsableasidtoken";
+    claims.put("id_token_hint", idToken);
+    AuthenticationRequest req = new AuthenticationRequest(claims);
+    req.verify();
+    Assert.assertEquals(idToken, req.getClaims().get("id_token_hint"));
+  }
+
 }
