Skip to content

Add OIDC issuer validation and new testing style #970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Jul 10, 2025

Conversation

Avery-Dunn
Copy link
Collaborator

This PR adds issuer validation for OIDC scenarios: 3268767

  • When using the oidcAuthority() API, a call is made to the OIDC discovery endpoint based on the authority set for the application
  • Part of the response is an expected issuer, and if this issuer differs from what we expect based on the authority we will throw an exception.

In addition, to test the issuer validation this PR builds on the work done in #968 to add a new testing style which was first proposed in MSAL Python: AzureAD/microsoft-authentication-library-for-python#825

  • Adds a new RunnerTest class containing barebones test outlines for a few scenarios, including issuer validation
  • Adds a new RunnerHelper class containing helper methods for RunnerTest: retrieve test cases from a central server, instantiate objects/execute methods/validate results all based on the test config
  • Adds several new classes in the testcase folder which represent and parses the content of test cases from the central server

@Avery-Dunn Avery-Dunn marked this pull request as ready for review June 16, 2025 18:06
@Avery-Dunn Avery-Dunn requested a review from a team as a code owner June 16, 2025 18:06
@@ -579,6 +579,10 @@ public T correlationId(String val) {
((OidcAuthority) authenticationAuthority).setAuthorityProperties(
OidcDiscoveryProvider.performOidcDiscovery(
(OidcAuthority) authenticationAuthority, this));

if (!((OidcAuthority) authenticationAuthority).isIssuerValid()) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This upcasting is a code smell. If you use inheritance, have you considered adding isIssuerValid to the base class Authority, where it simply returns true and have custom logic in OidcAuthority ?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the latest commit I rearranged the methods: the call to the validation method now happens in the setAuthorityProperties() method, so there are now no changes to this class and all the logic is contained within OidcAuthority

Copy link
Member

@bgavrilMS bgavrilMS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test infra is not ready. Maybe have a regular test instead?

@Avery-Dunn
Copy link
Collaborator Author

The test infra is not ready. Maybe have a regular test instead?

In the latest commit I removed the POC test infrastructure and added a new OidcAuthorityTest class to handle the tests in a more traditional way.

I had mainly added it to this PR to more easily get reviews/feedback on the new style, and I'll make a follow-up PR for those changes.

@Avery-Dunn Avery-Dunn requested a review from bgavrilMS July 8, 2025 20:24
@Avery-Dunn Avery-Dunn merged commit 3a4ed35 into dev Jul 10, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants