filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Include nonce parameter in id_tokens

Browse Source
This commit is contained in:
mdecimus
2024-10-03 15:07:38 +02:00
parent cce2d9c915
commit 292d1cc048
5 changed files with 57 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
tests/src/jmap/auth_oauth.rs
View File

@@ -11,6 +11,7 @@ use biscuit::{jwk::JWKSet, SingleOrMultiple, JWT};
use bytes::Bytes;
use common::auth::oauth::{
introspect::OAuthIntrospect,
oidc::Nonce,
registration::{ClientRegistrationRequest, ClientRegistrationResponse},
};
use imap_proto::ResponseType;
@@ -135,6 +136,7 @@ pub async fn test(params: &mut JMAPTest) {
// Obtain token
token_params.insert("redirect_uri".to_string(), "https://localhost".to_string());
token_params.insert("nonce".to_string(), "abc1234".to_string());
let (token, refresh_token, id_token) =
unwrap_oidc_token_response(post(&metadata.token_endpoint, &token_params).await);
@@ -154,16 +156,19 @@ pub async fn test(params: &mut JMAPTest) {
.is_empty());
// Verify ID token using the JWK set
let id_token = JWT::<(), biscuit::Empty>::new_encoded(&id_token)
let id_token = JWT::<Nonce, biscuit::Empty>::new_encoded(&id_token)
.decode_with_jwks(&jwk_set, None)
.unwrap();
let claims = &id_token.payload().unwrap().registered;
assert_eq!(claims.issuer, Some(oidc_metadata.issuer));
assert_eq!(claims.subject, Some(john_int_id.to_string()));
let claims = id_token.payload().unwrap();
let registered_claims = &claims.registered;
let private_claims = &claims.private;
assert_eq!(registered_claims.issuer, Some(oidc_metadata.issuer));
assert_eq!(registered_claims.subject, Some(john_int_id.to_string()));
assert_eq!(
claims.audience,
registered_claims.audience,
Some(SingleOrMultiple::Single(client_id.to_string()))
);
assert_eq!(private_claims.nonce, Some("abc1234".to_string()));
// Introspect token
let access_introspect: OAuthIntrospect = post_with_auth::<OAuthIntrospect>(

12
tests/src/jmap/mod.rs
View File

@@ -370,8 +370,8 @@ pub async fn jmap_tests() {
)
.await;
webhooks::test(&mut params).await;
/*email_query::test(&mut params, delete).await;
/*webhooks::test(&mut params).await;
email_query::test(&mut params, delete).await;
email_get::test(&mut params).await;
email_set::test(&mut params).await;
email_parse::test(&mut params).await;
@@ -384,9 +384,9 @@ pub async fn jmap_tests() {
mailbox::test(&mut params).await;
delivery::test(&mut params).await;
auth_acl::test(&mut params).await;
auth_limits::test(&mut params).await;
auth_limits::test(&mut params).await;*/
auth_oauth::test(&mut params).await;
event_source::test(&mut params).await;
/*event_source::test(&mut params).await;
push_subscription::test(&mut params).await;
sieve_script::test(&mut params).await;
vacation_response::test(&mut params).await;
@@ -394,10 +394,10 @@ pub async fn jmap_tests() {
websocket::test(&mut params).await;
quota::test(&mut params).await;
crypto::test(&mut params).await;
blob::test(&mut params).await;*/
blob::test(&mut params).await;
permissions::test(&params).await;
purge::test(&mut params).await;
enterprise::test(&mut params).await;
enterprise::test(&mut params).await;*/
if delete {
params.temp_dir.delete();