|
|
|
|
@ -85,7 +85,6 @@ import org.springframework.security.web.authentication.logout.LogoutHandler;
@@ -85,7 +85,6 @@ import org.springframework.security.web.authentication.logout.LogoutHandler;
|
|
|
|
|
import org.springframework.test.web.servlet.MockMvc; |
|
|
|
|
import org.springframework.test.web.servlet.MvcResult; |
|
|
|
|
import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; |
|
|
|
|
import org.springframework.util.StringUtils; |
|
|
|
|
import org.springframework.web.bind.annotation.GetMapping; |
|
|
|
|
import org.springframework.web.bind.annotation.PostMapping; |
|
|
|
|
import org.springframework.web.bind.annotation.RequestParam; |
|
|
|
|
@ -261,6 +260,22 @@ public class OidcLogoutConfigurerTests {
@@ -261,6 +260,22 @@ public class OidcLogoutConfigurerTests {
|
|
|
|
|
verify(sessionRegistry).removeSessionInformation(any(OidcLogoutToken.class)); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
void logoutWhenProviderIssuerMissingThenThrowIllegalArgumentException() throws Exception { |
|
|
|
|
this.spring.register(WebServerConfig.class, OidcProviderConfig.class, ProviderIssuerMissingConfig.class) |
|
|
|
|
.autowire(); |
|
|
|
|
String registrationId = this.clientRegistration.getRegistrationId(); |
|
|
|
|
MockHttpSession session = login(); |
|
|
|
|
String logoutToken = this.mvc.perform(get("/token/logout").session(session)) |
|
|
|
|
.andExpect(status().isOk()) |
|
|
|
|
.andReturn() |
|
|
|
|
.getResponse() |
|
|
|
|
.getContentAsString(); |
|
|
|
|
assertThatIllegalArgumentException().isThrownBy( |
|
|
|
|
() -> this.mvc.perform(post(this.web.url("/logout/connect/back-channel/" + registrationId).toString()) |
|
|
|
|
.param("logout_token", logoutToken))); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
private MockHttpSession login() throws Exception { |
|
|
|
|
MockMvcDispatcher dispatcher = (MockMvcDispatcher) this.web.getDispatcher(); |
|
|
|
|
this.mvc.perform(get("/token/logout")).andExpect(status().isUnauthorized()); |
|
|
|
|
@ -412,6 +427,54 @@ public class OidcLogoutConfigurerTests {
@@ -412,6 +427,54 @@ public class OidcLogoutConfigurerTests {
|
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Configuration |
|
|
|
|
static class ProviderIssuerMissingRegistrationConfig { |
|
|
|
|
|
|
|
|
|
@Autowired(required = false) |
|
|
|
|
MockWebServer web; |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
ClientRegistration clientRegistration() { |
|
|
|
|
if (this.web == null) { |
|
|
|
|
return TestClientRegistrations.clientRegistration().issuerUri(null).build(); |
|
|
|
|
} |
|
|
|
|
String issuer = this.web.url("/").toString(); |
|
|
|
|
return TestClientRegistrations.clientRegistration() |
|
|
|
|
.issuerUri(null) |
|
|
|
|
.jwkSetUri(issuer + "jwks") |
|
|
|
|
.tokenUri(issuer + "token") |
|
|
|
|
.userInfoUri(issuer + "user") |
|
|
|
|
.scope("openid") |
|
|
|
|
.build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
ClientRegistrationRepository clientRegistrationRepository(ClientRegistration clientRegistration) { |
|
|
|
|
return new InMemoryClientRegistrationRepository(clientRegistration); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Configuration |
|
|
|
|
@EnableWebSecurity |
|
|
|
|
@Import(ProviderIssuerMissingRegistrationConfig.class) |
|
|
|
|
static class ProviderIssuerMissingConfig { |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
@Order(1) |
|
|
|
|
SecurityFilterChain filters(HttpSecurity http) throws Exception { |
|
|
|
|
// @formatter:off
|
|
|
|
|
http |
|
|
|
|
.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated()) |
|
|
|
|
.oauth2Login(Customizer.withDefaults()) |
|
|
|
|
.oidcLogout((oidc) -> oidc.backChannel(Customizer.withDefaults())); |
|
|
|
|
// @formatter:on
|
|
|
|
|
|
|
|
|
|
return http.build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Configuration |
|
|
|
|
@EnableWebSecurity |
|
|
|
|
@EnableWebMvc |
|
|
|
|
@ -650,69 +713,4 @@ public class OidcLogoutConfigurerTests {
@@ -650,69 +713,4 @@ public class OidcLogoutConfigurerTests {
|
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
void logoutWhenProviderIssuerMissingThenThrowIllegalArgumentException() throws Exception { |
|
|
|
|
this.spring.register(WebServerConfig.class, OidcProviderConfig.class, ProviderIssuerMissingConfig.class).autowire(); |
|
|
|
|
String registrationId = this.clientRegistration.getRegistrationId(); |
|
|
|
|
MockHttpSession session = login(); |
|
|
|
|
String logoutToken = this.mvc.perform(get("/token/logout").session(session)) |
|
|
|
|
.andExpect(status().isOk()) |
|
|
|
|
.andReturn() |
|
|
|
|
.getResponse() |
|
|
|
|
.getContentAsString(); |
|
|
|
|
assertThatIllegalArgumentException().isThrownBy(() -> { |
|
|
|
|
this.mvc |
|
|
|
|
.perform(post(this.web.url("/logout/connect/back-channel/" + registrationId).toString()) |
|
|
|
|
.param("logout_token", logoutToken)); |
|
|
|
|
}); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Configuration |
|
|
|
|
static class ProviderIssuerMissingRegistrationConfig { |
|
|
|
|
|
|
|
|
|
@Autowired(required = false) |
|
|
|
|
MockWebServer web; |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
ClientRegistration clientRegistration() { |
|
|
|
|
if (this.web == null) { |
|
|
|
|
return TestClientRegistrations.clientRegistration().issuerUri(null).build(); |
|
|
|
|
} |
|
|
|
|
String issuer = this.web.url("/").toString(); |
|
|
|
|
return TestClientRegistrations.clientRegistration() |
|
|
|
|
.issuerUri(null) |
|
|
|
|
.jwkSetUri(issuer + "jwks") |
|
|
|
|
.tokenUri(issuer + "token") |
|
|
|
|
.userInfoUri(issuer + "user") |
|
|
|
|
.scope("openid") |
|
|
|
|
.build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
ClientRegistrationRepository clientRegistrationRepository(ClientRegistration clientRegistration) { |
|
|
|
|
return new InMemoryClientRegistrationRepository(clientRegistration); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Configuration |
|
|
|
|
@EnableWebSecurity |
|
|
|
|
@Import(ProviderIssuerMissingRegistrationConfig.class) |
|
|
|
|
static class ProviderIssuerMissingConfig { |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
@Order(1) |
|
|
|
|
SecurityFilterChain filters(HttpSecurity http) throws Exception { |
|
|
|
|
// @formatter:off
|
|
|
|
|
http |
|
|
|
|
.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated()) |
|
|
|
|
.oauth2Login(Customizer.withDefaults()) |
|
|
|
|
.oidcLogout((oidc) -> oidc.backChannel(Customizer.withDefaults())); |
|
|
|
|
// @formatter:on
|
|
|
|
|
|
|
|
|
|
return http.build(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
} |
|
|
|
|
|