IdTokenGranter { public boolean shouldSendIdToken(UaaUser user, BaseClientDetails clientDetails, Set<String> requestedScopes, String requestedGrantType ) { if (null == user || !GRANT_TYPES_THAT_MAY_GET_ID_TOKENS.contains(requestedGrantType)) { return false; } try { approvalService.ensureRequiredApprovals( user.getId(), Sets.newHashSet(REQUIRED_OPENID_SCOPE), requestedGrantType, clientDetails ); } catch (InvalidTokenException e) { return false; } Set<String> clientScopes = clientDetails.getScope(); if (null == clientScopes || clientScopes.isEmpty()) { return false; } if (clientScopes.stream() .filter(Objects::nonNull) .noneMatch(REQUIRED_OPENID_SCOPE::equals)) { return false; } if (requestedScopes != null && !requestedScopes.isEmpty() && !requestedScopes.contains(REQUIRED_OPENID_SCOPE)) { logger.info("an ID token was requested but 'openid' is missing from the requested scopes"); return false; } return true; } IdTokenGranter(ApprovalService approvalService); boolean shouldSendIdToken(UaaUser user,
                                     BaseClientDetails clientDetails,
                                     Set<String> requestedScopes,
                                     String requestedGrantType
    );  }
@Test public void shouldSend_isFalse_whenUserHasNotApprovedOpenidScope() { doThrow(InvalidTokenException.class).when(approvalService).ensureRequiredApprovals(any(), any(), any(), any()); assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, validGrantTypeForIdToken)); }
@Test public void shouldSend_isFalse_whenClientDoesNotHaveOpenIdScope() { assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithoutOpenid, requestedScopesWithOpenId, validGrantTypeForIdToken)); assertFalse(idTokenGranter.shouldSendIdToken(user, clientDetails, requestedScopesWithOpenId, validGrantTypeForIdToken)); BaseClientDetails clientWithoutOpenidAndWithNullScope = new BaseClientDetails(clientWithoutOpenid); assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithoutOpenidAndWithNullScope, requestedScopesWithOpenId, validGrantTypeForIdToken)); }
@Test public void shouldSend_isFalse_whenSAMLBearerGrantType() { assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_SAML2_BEARER)); }
@Test public void shouldSend_isFalse_whenJwtBearerGrantType() { assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_USER_TOKEN)); }
@Test public void shouldSend_isFalse_whenUserTokenGrantType() { assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_JWT_BEARER)); }
@Test public void shouldSend_isFalse_whenClientCredentialsGrantType() { assertFalse(idTokenGranter.shouldSendIdToken(null, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_CLIENT_CREDENTIALS)); }
@Test public void shouldSend_isFalse_whenClientHasOpenIdScope_andNonOpenIdScopesAreRequested() { assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithoutOpenId, validGrantTypeForIdToken)); }
@Test public void shouldSend_isTrue_whenClientHasOpenIdScope_andOpenIdScopeIsRequested_andIdTokenResponseType_GrantTypeIsImplicit() { assertTrue(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_IMPLICIT)); }
@Test public void shouldSend_isTrue_whenClientHasOpenIdScope_andOpenIdScopeIsRequested_andIdTokenResponseType_GrantTypeIsRefresh() { assertTrue(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_REFRESH_TOKEN)); }
@Test public void shouldSend_isTrue_whenAuthorizationCodeGrantIsUsed_withCodeResponseType() { assertTrue(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_AUTHORIZATION_CODE)); }
@Test public void shouldSend_isFalse_whenAuthorizationCodeGrantIsUsed_withCodeResponseType_withClientWithoutOpenId() { assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithoutOpenid, requestedScopesWithOpenId, GRANT_TYPE_AUTHORIZATION_CODE)); }
@Test public void shouldSend_isFalse_whenAuthorizationCodeGrantIsUsed_withCodeResponseType_withUnapprovedOpenId() { doThrow(InvalidTokenException.class).when(approvalService).ensureRequiredApprovals(any(), any(), any(), any()); assertFalse(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, requestedScopesWithOpenId, GRANT_TYPE_AUTHORIZATION_CODE)); }
@Test public void shouldSend_isTrue_whenClientHasOpenIdScope_andNoScopesRequested() { assertTrue(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, null, validGrantTypeForIdToken)); assertTrue(idTokenGranter.shouldSendIdToken(user, clientWithOpenId, Sets.newHashSet(), validGrantTypeForIdToken)); }