def test_collect_superiors():
# entity_id = 'https://feide.no'
entity_id = 'https://foodle.uninett.no'
target = 'https://foodle.uninett.no'
collector = DummyCollector(trusted_roots=ANCHOR,
httpd=Publisher(
os.path.join(BASE_PATH, 'base_data')),
root_dir=os.path.join(BASE_PATH, 'base_data'))
entity_statement = collector.get_entity_statement(
api_endpoint='https://foodle.uninett.no/fed_api',
issuer=entity_id,
subject=entity_id)
_config = verify_self_signed_signature(entity_statement)
assert _config
tree = collector.collect_superiors(_config['iss'], entity_statement)
node = {entity_id: (entity_statement, tree)}
chains = branch2lists(node)
assert len(chains) == 1 # only one chain
assert len(chains[0]) == 4 # And that chain contains 4 statements
_jws00 = factory(chains[0][0])
payload = _jws00.jwt.payload()
# The Federation Entity Statement will be first in line
assert payload["iss"] == 'https://feide.no'
def test_eval_chains():
target = 'https://foodle.uninett.no'
collector = DummyCollector(trusted_roots=ANCHOR,
httpd=Publisher(
os.path.join(BASE_PATH, 'base_data')),
root_dir=os.path.join(BASE_PATH, 'base_data'))
entity_statement = collector.get_entity_statement(target,
issuer=target,
subject=target)
_config = verify_self_signed_signature(entity_statement)
assert _config
tree = collector.collect_superiors(_config['iss'], entity_statement)
_node = {target: (entity_statement, tree)}
chains = branch2lists(_node)
key_jar = KeyJar()
key_jar.import_jwks_as_json(jwks, 'https://feide.no')
statements = [
eval_chain(c, key_jar, 'openid_relying_party') for c in chains
]
assert len(statements) == 1
statement = statements[0]
assert statement.fo == "https://feide.no"
assert set(statement.metadata.keys()) == {
'response_types', 'claims', 'contacts', 'application_type',
'redirect_uris', 'id_token_signing_alg_values_supported', 'jwks_uri'
}
def test_get_configuration_information():
target = 'https://foodle.uninett.no'
collector = DummyCollector(trusted_roots=ANCHOR,
httpd=Publisher(
os.path.join(BASE_PATH, 'base_data')),
root_dir=os.path.join(BASE_PATH, 'base_data'))
_jws = collector.get_configuration_information(target)
entity_statement = verify_self_signed_signature(_jws)
assert entity_statement['iss'] == target
assert entity_statement['sub'] == target
assert 'metadata' in entity_statement
def test_get_entity_statement():
entity_id = 'https://foodle.uninett.no'
target = 'https://foodle.uninett.no'
collector = DummyCollector(trusted_roots=ANCHOR,
httpd=Publisher(
os.path.join(BASE_PATH, 'base_data')),
root_dir=os.path.join(BASE_PATH, 'base_data'))
_jws = collector.get_entity_statement(
api_endpoint='https://foodle.uninett.no/fed_api',
issuer=entity_id,
subject=target)
msg = verify_self_signed_signature(_jws)
assert msg['iss'] == entity_id
assert msg['sub'] == target
def test_explicit_registration(self):
config = create_from_config_file(
Configuration,
entity_conf=[{
"class": FedRPConfiguration,
"attr": "rp"
}],
filename=full_path('conf_foodle.uninett.no.yaml'),
base_path=BASE_PATH)
config.rp.federation.web_cert_path = "{}/{}".format(
dir_path, lower_or_upper(config.web_conf, "server_cert"))
rph = init_oidc_rp_handler(config.rp, BASE_PATH)
rp = rph.init_client('ntnu')
rp.client_get(
"service_context").federation_entity.collector = DummyCollector(
httpd=Publisher(ROOT_DIR),
trusted_roots=ANCHOR,
root_dir=ROOT_DIR)
_service = rp.client_get("service", 'provider_info')
args = self.provider_endpoint.process_request()
info = self.provider_endpoint.do_response(**args)
_resp = _service.parse_response(info["response"])
with responses.RequestsMock() as rsps:
_jwks = open(
os.path.join(BASE_PATH, 'base_data', 'ntnu.no', 'op.ntnu.no',
'jwks.json')).read()
rsps.add("GET",
"https://op.ntnu.no/static/jwks.json",
body=_jwks,
adding_headers={"Content-Type": "application/json"},
status=200)
_service.update_service_context(_resp)
# Do the client registration request
# First let the client construct the client registration request
_service = rp.client_get("service", 'registration')
_request_args = _service.get_request_parameters()
# send it to the provider
args = self.registration_endpoint.process_request(
_request_args["body"])
response_args = self.provider_endpoint.do_response(**args)
# Let the client deal with the response from the provider
_resp = _service.parse_response(response_args["response"],
request=_request_args["body"])
_service.update_service_context(_resp)
# and we're done
reg_resp = _service.client_get("service_context").get(
"registration_response")
assert reg_resp["token_endpoint_auth_method"] == "private_key_jwt"
def create_op_enpoint_context(self):
cwd = os.getcwd()
if cwd.endswith('tests'):
sys.path.append(".")
else: # assume it's run from the package root dir
sys.path.append("tests")
import conf_op_umu_se
_conf = conf_op_umu_se.CONF.copy()
configuration = FedOpConfiguration(conf=_conf,
base_path=BASE_PATH,
domain="127.0.0.1",
port=443)
server = Server(configuration)
# _endpoint_context = init_oidc_op_endpoints(op_conf, BASE_PATH)
_endpoint_context = server.get_endpoint_context()
_endpoint_context.federation_entity.collector = DummyCollector(
httpd=Publisher(ROOT_DIR), trusted_roots=ANCHOR, root_dir=ROOT_DIR)
self.provider_endpoint = server.server_get("endpoint",
'provider_config')
self.registration_endpoint = server.server_get("endpoint",
"registration")
self.authorization_endpoint = server.server_get(
"endpoint", "authorization")
def rp_service_setup(self):
config = {
"entity_id": RECEIVER,
"httpc_params": {"verify": False, "timeout": 1},
"federation": {
"endpoint": {
"fetch": {
"path": "fetch",
"class": Fetch,
"kwargs": {"client_authn_method": None},
}
},
"trusted_roots": ANCHOR,
"authority_hints": [],
"entity_type": 'openid_relying_party',
"opponent_entity_type": 'openid_provider',
}
}
federation_entity = FederationEntity(
config=config,
httpc=Publisher(os.path.join(BASE_PATH, 'base_data')),
)
# Swap in the DummyCollector
federation_entity.collector = DummyCollector(trusted_roots=ANCHOR,
httpd=Publisher(
os.path.join(BASE_PATH, 'base_data')),
root_dir=os.path.join(BASE_PATH, 'base_data'))
self.fedent = federation_entity
def rp_service_setup(self):
federation_entity = FederationEntity(
RECEIVER,
trusted_roots=ANCHOR,
authority_hints={},
httpd=Publisher(os.path.join(BASE_PATH, 'base_data')),
entity_type='openid_relying_party',
opponent_entity_type='openid_provider')
# Swap in the DummyCollector
federation_entity.collector = DummyCollector(
trusted_roots=ANCHOR,
httpd=Publisher(os.path.join(BASE_PATH, 'base_data')),
root_dir=os.path.join(BASE_PATH, 'base_data'))
self.fedent = federation_entity
def create_endpoint(self):
conf = {
"issuer": ENTITY_ID,
"password": "******",
"token_expires_in": 600,
"grant_expires_in": 300,
"refresh_token_expires_in": 86400,
"verify_ssl": False,
'keys': {
'key_defs': KEYSPEC
},
"endpoint": {},
"jwks": {
"private_path": "own/jwks.json",
"uri_path": "static/jwks.json"
},
"authentication": {
"anon": {
'acr': UNSPECIFIED,
"class": NoAuthn,
"kwargs": {
"user": "******"
}
}
},
'template_dir': 'template'
}
endpoint_context = EndpointContext(conf)
self.endpoint = ProviderConfiguration(endpoint_context)
# === Federation stuff =======
fe_conf = {'keys': {'key_defs': KEYSPEC}}
federation_entity = FederationEntity(
ENTITY_ID,
trusted_roots=ANCHOR,
authority_hints={'https://ntnu.no': ['https://feide.no']},
httpd=Publisher(ROOT_DIR),
config=fe_conf,
entity_type='openid_relying_party',
opponent_entity_type='openid_provider')
federation_entity.collector = DummyCollector(httpd=Publisher(
os.path.join(BASE_PATH, 'data')),
trusted_roots=ANCHOR,
root_dir=ROOT_DIR)
self.fedent = federation_entity
self.endpoint.endpoint_context.federation_entity = federation_entity
def create_op_enpoint_context(self):
cwd = os.getcwd()
if cwd.endswith('tests'):
sys.path.append(".")
else: # assume it's run from the package root dir
sys.path.append("tests")
import conf_op_ntnu_no
_conf = conf_op_ntnu_no.CONF.copy()
add_base_path(
_conf, {
"session_key": ['filename'],
"keys": ['private_path', 'public_path'],
"jwks": ["private_path", "public_path"],
"": ["template"]
}, dir_path)
add_base_path(
_conf["federation"], {
"session_key": ['filename'],
"keys": ['private_path', 'public_path'],
"": ["authority_hints", "trusted_roots"]
}, dir_path)
add_base_path(_conf["token_handler_args"], {
"jwks_def": ['private_path', 'public_path'],
}, dir_path)
add_base_path(_conf["userinfo"], {
"kwargs": ['db_file'],
}, dir_path)
add_base_path(_conf["cookie_dealer"], {
"sign_jwk": ['filename'],
}, dir_path)
server = Server(_conf)
# _endpoint_context = init_oidc_op_endpoints(op_conf, BASE_PATH)
_endpoint_context = server.get_endpoint_context()
_endpoint_context.federation_entity.collector = DummyCollector(
httpd=Publisher(ROOT_DIR), trusted_roots=ANCHOR, root_dir=ROOT_DIR)
self.provider_endpoint = server.server_get("endpoint",
'provider_config')
self.registration_endpoint = server.server_get("endpoint",
"registration")
self.authorization_endpoint = server.server_get(
"endpoint", "authorization")
def test_automatic_registration(self):
config = create_from_config_file(
Configuration,
entity_conf=[{
"class": FedRPConfiguration,
"attr": "rp"
}],
filename=full_path('conf_foodle.uninett.no.yaml'),
base_path=BASE_PATH)
rph = init_oidc_rp_handler(config.rp, BASE_PATH)
rp = rph.init_client('ntnu')
rp.client_get(
"service_context").federation_entity.collector = DummyCollector(
httpd=Publisher(ROOT_DIR),
trusted_roots=ANCHOR,
root_dir=ROOT_DIR)
_service = rp.client_get("service", 'provider_info')
# don't need to parse the request since there is none
args = self.provider_endpoint.process_request()
info = self.provider_endpoint.do_response(**args)
_resp = _service.parse_response(info["response"])
with responses.RequestsMock() as rsps:
_jwks = open(
os.path.join(BASE_PATH, 'base_data', 'ntnu.no', 'op.ntnu.no',
'jwks.json')).read()
rsps.add("GET",
"https://op.ntnu.no/static/jwks.json",
body=_jwks,
adding_headers={"Content-Type": "application/json"},
status=200)
_service.update_service_context(_resp)
# Do the client authorization request
# First let the client construct the authorization request
_service = rp.client_get("service", 'authorization')
_request_args = _service.get_request_parameters()
# send it to the provider
_req_args = parse_qs(_request_args['url'].split('?')[1])
with responses.RequestsMock() as rsps:
_jwks = open(os.path.join(BASE_PATH,
'static/jwks_auto.json')).read()
_url = 'https://foodle.uninett.no/jwks.json'
rsps.add("GET",
_url,
body=_jwks,
adding_headers={"Content-Type": "application/json"},
status=200)
_req_args = self.authorization_endpoint.parse_request(
compact(_req_args))
# need to register a user session info
args = self.authorization_endpoint.process_request(_req_args)
response_args = self.authorization_endpoint.do_response(**args)
# Let the client deal with the response from the provider
_resp = _service.parse_response(response_args["response"],
request=compact(_req_args))
_service.update_service_context(_resp)
# and we're done
assert 'trust_anchor_id' in _resp
def create_endpoint(self):
conf = {
"issuer": ENTITY_ID,
"password": "******",
"token_expires_in": 600,
"grant_expires_in": 300,
"refresh_token_expires_in": 86400,
"verify_ssl": False,
"claims_interface": {
"class": "oidcop.session.claims.ClaimsInterface",
"kwargs": {}
},
'keys': {
'key_defs': KEYSPEC,
"private_path": "own/jwks.json",
"uri_path": "static/jwks.json"
},
"endpoint": {
"provider_config": {
"path": ".well-known/openid-configuration",
"class": ProviderConfiguration,
"kwargs": {},
}
},
"authentication": {
"anon": {
'acr': UNSPECIFIED,
"class": NoAuthn,
"kwargs": {
"user": "******"
}
}
},
'template_dir': 'template',
"federation": {
"entity_id": ENTITY_ID,
'keys': {
'key_defs': KEYSPEC
},
"endpoint": {
"fetch": {
"path": "fetch",
"class": Fetch,
"kwargs": {
"client_authn_method": None
},
}
},
"trusted_roots": ANCHOR,
"authority_hints": ['https://feide.no'],
"entity_type": 'openid_relying_party',
"opponent_entity_type": 'openid_provider'
}
}
server = FederationServer(conf)
self.endpoint = server.server_get('endpoint', 'provider_config')
server.endpoint_context.federation_entity.collector = DummyCollector(
httpd=Publisher(os.path.join(BASE_PATH, 'data')),
trusted_roots=ANCHOR,
root_dir=ROOT_DIR)