Skip to content

Commit f3d54e4

Browse files
ssddanbrownssddanbrown
committed
Added positive test case for OIDC implementation
- To continue coverage and spec cases next.
1 parent 6b182a4 commit f3d54e4

File tree

3 files changed

+127
-4
lines changed

3 files changed

+127
-4
lines changed

‎app/Auth/Access/OpenIdConnect/JwtSigningKey.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,15 +60,19 @@ protected function loadFromJwkArray(array $jwk)
6060
throw new InvalidKeyException("Only RS256 keys are currently supported. Found key using {$jwk['alg']}");
6161
}
6262

63+
if (empty($jwk['use'])) {
64+
throw new InvalidKeyException('A "use" parameter on the provided key is expected');
65+
}
66+
6367
if ($jwk['use'] !== 'sig') {
64-
throw new InvalidKeyException("Only signature keys are currently supported. Found key for use {$jwk['sig']}");
68+
throw new InvalidKeyException("Only signature keys are currently supported. Found key for use {$jwk['use']}");
6569
}
6670

67-
if (empty($jwk['e'] ?? '')) {
71+
if (empty($jwk['e'])) {
6872
throw new InvalidKeyException('An "e" parameter on the provided key is expected');
6973
}
7074

71-
if (empty($jwk['n'] ?? '')) {
75+
if (empty($jwk['n'])) {
7276
throw new InvalidKeyException('A "n" parameter on the provided key is expected');
7377
}
7478

‎app/Auth/Access/OpenIdConnect/OpenIdConnectIdToken.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,12 @@ protected function base64UrlDecode(string $encoded): string
7676
* Validate all possible parts of the id token.
7777
* @throws InvalidTokenException
7878
*/
79-
public function validate(string $clientId)
79+
public function validate(string $clientId): bool
8080
{
8181
$this->validateTokenStructure();
8282
$this->validateTokenSignature();
8383
$this->validateTokenClaims($clientId);
84+
return true;
8485
}
8586

8687
/**

‎tests/Unit/OpenIdConnectIdTokenTest.php‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
<?php
2+
3+
namespace Tests\Unit;
4+
5+
use BookStack\Auth\Access\OpenIdConnect\OpenIdConnectIdToken;
6+
use phpseclib3\Crypt\RSA;
7+
use Tests\TestCase;
8+
9+
class OpenIdConnectIdTokenTest extends TestCase
10+
{
11+
12+
public function test_valid_token_passes_validation()
13+
{
14+
$token = new OpenIdConnectIdToken($this->getValidToken(), 'https://auth.example.com', [
15+
$this->jwkKeyArray()
16+
]);
17+
18+
$this->assertTrue($token->validate('xxyyzz.aaa.bbccdd.123'));
19+
}
20+
21+
protected function getValidToken($payloadOverrides = []): string
22+
{
23+
$defaultPayload = [
24+
"sub" => "abc1234def",
25+
"name" => "Barry Scott",
26+
"email" => "bscott@example.com",
27+
"ver" => 1,
28+
"iss" => "https://auth.example.com",
29+
"aud" => "xxyyzz.aaa.bbccdd.123",
30+
"iat" => time(),
31+
"exp" => time() + 720,
32+
"jti" => "ID.AaaBBBbbCCCcccDDddddddEEEeeeeee",
33+
"amr" => ["pwd"],
34+
"idp" => "fghfghgfh546456dfgdfg",
35+
"preferred_username" => "xXBazzaXx",
36+
"auth_time" => time(),
37+
"at_hash" => "sT4jbsdSGy9w12pq3iNYDA",
38+
];
39+
40+
$payload = array_merge($defaultPayload, $payloadOverrides);
41+
$header = [
42+
'kid' => 'xyz456',
43+
'alg' => 'RS256',
44+
];
45+
46+
$top = implode('.', [
47+
$this->base64UrlEncode(json_encode($header)),
48+
$this->base64UrlEncode(json_encode($payload)),
49+
]);
50+
51+
$privateKey = RSA::loadPrivateKey($this->privatePemKey())->withPadding(RSA::SIGNATURE_PKCS1);
52+
$signature = $privateKey->sign($top);
53+
54+
return $top . '.' . $this->base64UrlEncode($signature);
55+
}
56+
57+
protected function base64UrlEncode(string $decoded): string
58+
{
59+
return strtr(base64_encode($decoded), '+/', '-_');
60+
}
61+
62+
protected function pemKey(): string
63+
{
64+
return "-----BEGIN PUBLIC KEY-----
65+
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqo1OmfNKec5S2zQC4SP9
66+
DrHuUR0VgCi6oqcGERz7zqO36hqk3A3R3aCgJkEjfnbnMuszRRKs45NbXoOp9pvm
67+
zXL16c93Obn7G8x8A3ao6yN5qKO5S5+CETqOZfKN/g75Xlz7VsC3igOhgsXnPx6i
68+
iM6sbYbk0U/XpFaT84LXKI8VTIPUo7gTeZN1pTET//i9FlzAOzX+xfWBKdOqlEzl
69+
+zihMHCZUUvQu99P+o0MDR0lMUT+vPJ6SJeRfnoHexwt6bZFiNnsZIEL03bX4QNk
70+
WvsLta1+jNUee+8IPVhzCO8bvM86NzLaKUJ4k6NZ5IVrmdCFpFsjCWByOrDG8wdw
71+
3wIDAQAB
72+
-----END PUBLIC KEY-----";
73+
}
74+
75+
protected function privatePemKey(): string
76+
{
77+
return "-----BEGIN PRIVATE KEY-----
78+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCqjU6Z80p5zlLb
79+
NALhI/0Ose5RHRWAKLqipwYRHPvOo7fqGqTcDdHdoKAmQSN+ducy6zNFEqzjk1te
80+
g6n2m+bNcvXpz3c5ufsbzHwDdqjrI3moo7lLn4IROo5l8o3+DvleXPtWwLeKA6GC
81+
xec/HqKIzqxthuTRT9ekVpPzgtcojxVMg9SjuBN5k3WlMRP/+L0WXMA7Nf7F9YEp
82+
06qUTOX7OKEwcJlRS9C730/6jQwNHSUxRP688npIl5F+egd7HC3ptkWI2exkgQvT
83+
dtfhA2Ra+wu1rX6M1R577wg9WHMI7xu8zzo3MtopQniTo1nkhWuZ0IWkWyMJYHI6
84+
sMbzB3DfAgMBAAECggEADm7K2ghWoxwsstQh8j+DaLzx9/dIHIJV2PHdd5FGVeRQ
85+
6gS7MswQmHrBUrtsb4VMZ2iz/AJqkw+jScpGldH3pCc4XELsSfxNHbseO4TNIqjr
86+
4LOKOLYU4bRc3I+8KGXIAI5JzrucTJemEVUCDrte8cjbmqExt+zTyNpyxsapworF
87+
v+vnSdv40d62f+cS1xvwB+ymLK/B/wZ/DemDCi8jsi7ou/M7l5xNCzjH4iMSLtOW
88+
fgEhejIBG9miMJWPiVpTXE3tMdNuN3OsWc4XXm2t4VRovlZdu30Fax1xWB+Locsv
89+
HlHKLOFc8g+jZh0TL2KCNjPffMcC7kHhW3afshpIsQKBgQDhyWUnkqd6FzbwIX70
90+
SnaMgKoUv5W/K5T+Sv/PA2CyN8Gu8ih/OsoNZSnI0uqe3XQIvvgN/Fq3wO1ttLzf
91+
z5B6ZC7REfTgcR0190gihk6f5rtcj7d6Fy/oG2CE8sDSXgPnpEaBjvJVgN5v/U2s
92+
HpVaidmHTyGLCfEszoeoy8jyrQKBgQDBX8caGylmzQLc6XNntZChlt3e18Nj8MPA
93+
DxWLcoqgdDoofLDQAmLl+vPKyDmhQjos5eas1jgmVVEM4ge+MysaVezvuLBsSnOh
94+
ihc0i63USU6i7YDE83DrCewCthpFHi/wW1S5FoCAzpVy8y99vwcqO4kOXcmf4O6Y
95+
uW6sMsjvOwKBgQDbFtqB+MtsLCSSBF61W6AHHD5tna4H75lG2623yXZF2NanFLF5
96+
K6muL9DI3ujtOMQETJJUt9+rWJjLEEsJ/dYa/SV0l7D/LKOEnyuu3JZkkLaTzZzi
97+
6qcA2bfhqdCzEKlHV99WjkfV8hNlpex9rLuOPB8JLh7FVONicBGxF/UojQKBgDXs
98+
IlYaSuI6utilVKQP0kPtEPOKERc2VS+iRSy8hQGXR3xwwNFQSQm+f+sFCGT6VcSd
99+
W0TI+6Fc2xwPj38vP465dTentbKM1E+wdSYW6SMwSfhO6ECDbfJsst5Sr2Kkt1N7
100+
9FUkfDLu6GfEfnK/KR1SurZB2u51R7NYyg7EnplvAoGAT0aTtOcck0oYN30g5mdf
101+
efqXPwg2wAPYeiec49EbfnteQQKAkqNfJ9K69yE2naf6bw3/5mCBsq/cXeuaBMII
102+
ylysUIRBqt2J0kWm2yCpFWR7H+Ilhdx9A7ZLCqYVt8e+vjO/BOI3cQDe2VPOLPSl
103+
q/1PY4iJviGKddtmfClH3v4=
104+
-----END PRIVATE KEY-----";
105+
}
106+
107+
protected function jwkKeyArray(): array
108+
{
109+
return [
110+
'kty' => 'RSA',
111+
'alg' => 'RS256',
112+
'kid' => '066e52af-8884-4926-801d-032a276f9f2a',
113+
'use' => 'sig',
114+
'e' => 'AQAB',
115+
'n' => 'qo1OmfNKec5S2zQC4SP9DrHuUR0VgCi6oqcGERz7zqO36hqk3A3R3aCgJkEjfnbnMuszRRKs45NbXoOp9pvmzXL16c93Obn7G8x8A3ao6yN5qKO5S5-CETqOZfKN_g75Xlz7VsC3igOhgsXnPx6iiM6sbYbk0U_XpFaT84LXKI8VTIPUo7gTeZN1pTET__i9FlzAOzX-xfWBKdOqlEzl-zihMHCZUUvQu99P-o0MDR0lMUT-vPJ6SJeRfnoHexwt6bZFiNnsZIEL03bX4QNkWvsLta1-jNUee-8IPVhzCO8bvM86NzLaKUJ4k6NZ5IVrmdCFpFsjCWByOrDG8wdw3w',
116+
];
117+
}
118+
}

0 commit comments

Comments
 (0)