IdTokenCreator { public IdToken create(ClientDetails clientDetails, UaaUser uaaUser, UserAuthenticationData userAuthenticationData) throws IdTokenCreationException { Date expiryDate = tokenValidityResolver.resolve(clientDetails.getClientId()); Date issuedAt = timeService.getCurrentDate(); String givenName = getIfScopeContainsProfile(uaaUser.getGivenName(), userAuthenticationData.scopes); String familyName = getIfScopeContainsProfile(uaaUser.getFamilyName(), userAuthenticationData.scopes); String phoneNumber = getIfScopeContainsProfile(uaaUser.getPhoneNumber(), userAuthenticationData.scopes); String issuerUrl = tokenEndpointBuilder.getTokenEndpoint(identityZoneManager.getCurrentIdentityZone()); String identityZoneId = identityZoneManager.getCurrentIdentityZoneId(); Map<String, List<String>> userAttributes = buildUserAttributes(userAuthenticationData, uaaUser); Set<String> roles = buildRoles(userAuthenticationData, uaaUser); String clientTokenSalt = (String) clientDetails.getAdditionalInformation().get(ClientConstants.TOKEN_SALT); String revSig = getRevocableTokenSignature(uaaUser, clientTokenSalt, clientDetails.getClientId(), clientDetails.getClientSecret()); return new IdToken( getIfNotExcluded(uaaUser.getId(), USER_ID), getIfNotExcluded(newArrayList(clientDetails.getClientId()), AUD), getIfNotExcluded(issuerUrl, ISS), getIfNotExcluded(expiryDate, EXP), getIfNotExcluded(issuedAt, IAT), getIfNotExcluded(userAuthenticationData.authTime, AUTH_TIME), getIfNotExcluded(userAuthenticationData.authenticationMethods, AMR), getIfNotExcluded(userAuthenticationData.contextClassRef, ACR), getIfNotExcluded(clientDetails.getClientId(), AZP), getIfNotExcluded(givenName, GIVEN_NAME), getIfNotExcluded(familyName, FAMILY_NAME), getIfNotExcluded(uaaUser.getPreviousLogonTime(), PREVIOUS_LOGON_TIME), getIfNotExcluded(phoneNumber, PHONE_NUMBER), getIfNotExcluded(roles, ROLES), getIfNotExcluded(userAttributes, USER_ATTRIBUTES), getIfNotExcluded(uaaUser.isVerified(), EMAIL_VERIFIED), getIfNotExcluded(userAuthenticationData.nonce, NONCE), getIfNotExcluded(uaaUser.getEmail(), EMAIL), getIfNotExcluded(clientDetails.getClientId(), CID), getIfNotExcluded(userAuthenticationData.grantType, GRANT_TYPE), getIfNotExcluded(uaaUser.getUsername(), USER_NAME), getIfNotExcluded(identityZoneId, ZONE_ID), getIfNotExcluded(uaaUser.getOrigin(), ORIGIN), getIfNotExcluded(userAuthenticationData.jti, JTI), getIfNotExcluded(revSig, REVOCATION_SIGNATURE)); } IdTokenCreator(final TokenEndpointBuilder tokenEndpointBuilder,
                          final TimeService timeService,
                          final TokenValidityResolver tokenValidityResolver,
                          final UaaUserDatabase uaaUserDatabase,
                          final MultitenantClientServices multitenantClientServices,
                          final Set<String> excludedClaims,
                          final IdentityZoneManager identityZoneManager); IdToken create(ClientDetails clientDetails,
                          UaaUser uaaUser,
                          UserAuthenticationData userAuthenticationData); void setTimeService(TimeService timeService);  }
@Test void create_includesStandardClaims() throws IdTokenCreationException { IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken, is(notNullValue())); assertThat(idToken.sub, is("id1234")); assertThat(idToken.aud, hasItem(clientId)); assertThat(idToken.iss, is(issuerUrl)); assertThat(idToken.exp, is(expDate)); assertThat(idToken.iat, is(iatDate)); assertThat(idToken.authTime, is(authTime)); assertThat(idToken.amr, hasItems(is("mfa"), is("ext"))); assertThat(idToken.acr, hasItems(is("urn:oasis:names:tc:SAML:2.0:ac:classes:Password"))); assertThat(idToken.azp, is(clientId)); }
@Test void create_includesAdditionalClaims() throws IdTokenCreationException { IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken, is(notNullValue())); assertThat(idToken.givenName, is(givenName)); assertThat(idToken.familyName, is(familyName)); assertThat(idToken.previousLogonTime, is(previousLogonTime)); assertThat(idToken.phoneNumber, is(phoneNumber)); assertThat(idToken.roles, is(roles)); assertThat(idToken.userAttributes, is(userAttributes)); assertThat(idToken.scope, hasItem("openid")); assertThat(idToken.emailVerified, is(true)); assertThat(idToken.nonce, is(nonce)); assertThat(idToken.email, is("spongebob@krustykrab.com")); assertThat(idToken.clientId, is(clientId)); assertThat(idToken.grantType, is(grantType)); assertThat(idToken.userName, is(userName)); assertThat(idToken.zid, is(zoneId)); assertThat(idToken.origin, is(origin)); assertThat(idToken.jti, is("accessTokenId")); assertThat(idToken.revSig, is("a039bd5")); }
@Test void create_includesEmailVerified() throws IdTokenCreationException { user.setVerified(false); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.emailVerified, is(false)); }
@Test void create_doesntPopulateRolesWhenScopeDoesntContainRoles() throws IdTokenCreationException { scopes.clear(); scopes.add("openid"); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.roles, nullValue()); }
@Test void create_setsRolesToNullIfThereAreNoRoles() throws IdTokenCreationException { roles.clear(); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.roles, nullValue()); }
@Test void create_setsRolesToNullIfRolesAreNull() throws IdTokenCreationException { userAuthenticationData = new UserAuthenticationData( authTime, amr, acr, scopes, null, userAttributes, nonce, grantType, jti); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.roles, nullValue()); }
@Test void create_doesntPopulateUserAttributesWhenScopeDoesntContainUserAttributes() throws IdTokenCreationException { scopes.clear(); scopes.add("openid"); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.userAttributes, nullValue()); }
@Test void create_doesntSetUserAttributesIfTheyAreNull() throws IdTokenCreationException { userAuthenticationData = new UserAuthenticationData( authTime, amr, acr, scopes, roles, null, nonce, grantType, jti); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.userAttributes, nullValue()); }
@Test void create_doesntPopulateNamesAndPhone_whenNoProfileScopeGiven() throws IdTokenCreationException { scopes.remove("profile"); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.givenName, is(nullValue())); assertThat(idToken.familyName, is(nullValue())); assertThat(idToken.phoneNumber, is(nullValue())); }
@Test void create_doesntIncludesExcludedClaims() throws IdTokenCreationException { excludedClaims.add(ClaimConstants.USER_ID); excludedClaims.add(ClaimConstants.AUD); excludedClaims.add(ClaimConstants.ISS); excludedClaims.add(ClaimConstants.EXP); excludedClaims.add(ClaimConstants.IAT); excludedClaims.add(ClaimConstants.AUTH_TIME); excludedClaims.add(ClaimConstants.AMR); excludedClaims.add(ClaimConstants.ACR); excludedClaims.add(ClaimConstants.AZP); excludedClaims.add(ClaimConstants.GIVEN_NAME); excludedClaims.add(ClaimConstants.FAMILY_NAME); excludedClaims.add(ClaimConstants.PREVIOUS_LOGON_TIME); excludedClaims.add(ClaimConstants.PHONE_NUMBER); excludedClaims.add(ClaimConstants.ROLES); excludedClaims.add(ClaimConstants.USER_ATTRIBUTES); excludedClaims.add(ClaimConstants.EMAIL_VERIFIED); excludedClaims.add(ClaimConstants.NONCE); excludedClaims.add(ClaimConstants.EMAIL); excludedClaims.add(ClaimConstants.CID); excludedClaims.add(ClaimConstants.GRANT_TYPE); excludedClaims.add(ClaimConstants.USER_NAME); excludedClaims.add(ClaimConstants.ZONE_ID); excludedClaims.add(ClaimConstants.ORIGIN); excludedClaims.add(ClaimConstants.JTI); excludedClaims.add(ClaimConstants.REVOCATION_SIGNATURE); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.sub, is(nullValue())); assertThat(idToken.aud, is(nullValue())); assertThat(idToken.iss, is(nullValue())); assertThat(idToken.exp, is(nullValue())); assertThat(idToken.iat, is(nullValue())); assertThat(idToken.authTime, is(nullValue())); assertThat(idToken.amr, is(nullValue())); assertThat(idToken.acr, is(nullValue())); assertThat(idToken.azp, is(nullValue())); assertThat(idToken.givenName, is(nullValue())); assertThat(idToken.familyName, is(nullValue())); assertThat(idToken.previousLogonTime, is(nullValue())); assertThat(idToken.phoneNumber, is(nullValue())); assertThat(idToken.roles, is(nullValue())); assertThat(idToken.userAttributes, is(nullValue())); assertThat(idToken.emailVerified, is(nullValue())); assertThat(idToken.nonce, is(nullValue())); assertThat(idToken.email, is(nullValue())); assertThat(idToken.clientId, is(nullValue())); assertThat(idToken.grantType, is(nullValue())); assertThat(idToken.userName, is(nullValue())); assertThat(idToken.zid, is(nullValue())); assertThat(idToken.origin, is(nullValue())); assertThat(idToken.jti, is(nullValue())); assertThat(idToken.revSig, is(nullValue())); }
@Test void idToken_containsZonifiedIssuerUrl() throws Exception { IdentityZone mockIdentityZone = mock(IdentityZone.class); when(mockIdentityZone.isUaa()).thenReturn(false); when(mockIdentityZone.getSubdomain()).thenReturn("myzone"); when(mockIdentityZoneManager.getCurrentIdentityZone()).thenReturn(mockIdentityZone); IdToken idToken = tokenCreator.create(clientDetails, user, userAuthenticationData); assertThat(idToken.iss, is("http: }