-
Notifications
You must be signed in to change notification settings - Fork 148
Add OIDC issuer validation and new testing style #970
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AbstractClientApplicationBase.java
Outdated
Show resolved
Hide resolved
msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/OidcAuthority.java
Outdated
Show resolved
Hide resolved
@@ -579,6 +579,10 @@ public T correlationId(String val) { | |||
((OidcAuthority) authenticationAuthority).setAuthorityProperties( | |||
OidcDiscoveryProvider.performOidcDiscovery( | |||
(OidcAuthority) authenticationAuthority, this)); | |||
|
|||
if (!((OidcAuthority) authenticationAuthority).isIssuerValid()) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This upcasting is a code smell. If you use inheritance, have you considered adding isIssuerValid
to the base class Authority
, where it simply returns true and have custom logic in OidcAuthority
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the latest commit I rearranged the methods: the call to the validation method now happens in the setAuthorityProperties() method, so there are now no changes to this class and all the logic is contained within OidcAuthority
msal4j-sdk/src/main/java/com/microsoft/aad/msal4j/AbstractClientApplicationBase.java
Outdated
Show resolved
Hide resolved
msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/testcase/Act.java
Outdated
Show resolved
Hide resolved
msal4j-sdk/src/test/java/com/microsoft/aad/msal4j/RunnerTest.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The test infra is not ready. Maybe have a regular test instead?
In the latest commit I removed the POC test infrastructure and added a new OidcAuthorityTest class to handle the tests in a more traditional way. I had mainly added it to this PR to more easily get reviews/feedback on the new style, and I'll make a follow-up PR for those changes. |
This PR adds issuer validation for OIDC scenarios: 3268767
oidcAuthority()
API, a call is made to the OIDC discovery endpoint based on the authority set for the applicationIn addition, to test the issuer validation this PR builds on the work done in #968 to add a new testing style which was first proposed in MSAL Python: AzureAD/microsoft-authentication-library-for-python#825
RunnerTest
class containing barebones test outlines for a few scenarios, including issuer validationRunnerHelper
class containing helper methods forRunnerTest
: retrieve test cases from a central server, instantiate objects/execute methods/validate results all based on the test configtestcase
folder which represent and parses the content of test cases from the central server