Unit test for #2496
This commit is contained in:
parent
b8e8bbcedd
commit
275567436e
|
@ -17,13 +17,14 @@ my $debug = 'error';
|
||||||
# Initialization
|
# Initialization
|
||||||
my $op = LLNG::Manager::Test->new( {
|
my $op = LLNG::Manager::Test->new( {
|
||||||
ini => {
|
ini => {
|
||||||
logLevel => $debug,
|
logLevel => $debug,
|
||||||
domain => 'op.com',
|
domain => 'op.com',
|
||||||
portal => 'http://auth.op.com',
|
portal => 'http://auth.op.com',
|
||||||
authentication => 'Demo',
|
authentication => 'Demo',
|
||||||
userDB => 'Same',
|
userDB => 'Same',
|
||||||
issuerDBOpenIDConnectActivation => 1,
|
issuerDBOpenIDConnectActivation => 1,
|
||||||
oidcRPMetaDataExportedVars => {
|
oidcServiceAllowOnlyDeclaredScopes => 1,
|
||||||
|
oidcRPMetaDataExportedVars => {
|
||||||
rp => {
|
rp => {
|
||||||
email => "mail",
|
email => "mail",
|
||||||
family_name => "cn",
|
family_name => "cn",
|
||||||
|
@ -37,13 +38,18 @@ my $op = LLNG::Manager::Test->new( {
|
||||||
},
|
},
|
||||||
oidcRPMetaDataScopeRules => {
|
oidcRPMetaDataScopeRules => {
|
||||||
rp => {
|
rp => {
|
||||||
"read" => '$requested and $uid eq "french"',
|
"read" => '$requested and $uid eq "french"',
|
||||||
"write" => '$uid eq "russian"',
|
"write" => '$uid eq "russian"',
|
||||||
"ifrequested" => '$requested and $uid eq "french"',
|
"ifrequested" => '$requested and $uid eq "french"',
|
||||||
"always" => '$uid eq "french"',
|
"always" => '$uid eq "french"',
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
oidcRPMetaDataOptions => {
|
oidcRPMetaDataOptionsExtraClaims => {
|
||||||
|
rp => {
|
||||||
|
extrascope => "dummy",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
oidcRPMetaDataOptions => {
|
||||||
rp => {
|
rp => {
|
||||||
oidcRPMetaDataOptionsDisplayName => "RP",
|
oidcRPMetaDataOptionsDisplayName => "RP",
|
||||||
oidcRPMetaDataOptionsIDTokenExpiration => 3600,
|
oidcRPMetaDataOptionsIDTokenExpiration => 3600,
|
||||||
|
@ -73,7 +79,7 @@ my $code = authorize(
|
||||||
$op, $idpId,
|
$op, $idpId,
|
||||||
{
|
{
|
||||||
response_type => "code",
|
response_type => "code",
|
||||||
scope => "openid profile email read write",
|
scope => "openid profile email read write extrascope unknown",
|
||||||
client_id => "rpid",
|
client_id => "rpid",
|
||||||
state => "af0ifjsldkj",
|
state => "af0ifjsldkj",
|
||||||
redirect_uri => "http://rp2.com/"
|
redirect_uri => "http://rp2.com/"
|
||||||
|
@ -85,7 +91,7 @@ my $json = expectJSON( codeGrant( $op, "rpid", $code, "http://rp2.com/" ) );
|
||||||
my $token = $json->{access_token};
|
my $token = $json->{access_token};
|
||||||
ok( $token, 'Access token present' );
|
ok( $token, 'Access token present' );
|
||||||
my $token_resp_scope = $json->{scope};
|
my $token_resp_scope = $json->{scope};
|
||||||
ok ($token_resp_scope, 'Token response returned granted scopes');
|
ok( $token_resp_scope, 'Token response returned granted scopes' );
|
||||||
|
|
||||||
my ( $res, $query );
|
my ( $res, $query );
|
||||||
|
|
||||||
|
@ -126,11 +132,20 @@ is( $json->{client_id}, "rpid", "Response contains the correct client id" );
|
||||||
like( $json->{scope}, qr/\bopenid\b/, "Response contains the default scopes" );
|
like( $json->{scope}, qr/\bopenid\b/, "Response contains the default scopes" );
|
||||||
like( $json->{scope}, qr/\bprofile\b/, "Response contains the default scopes" );
|
like( $json->{scope}, qr/\bprofile\b/, "Response contains the default scopes" );
|
||||||
like( $json->{scope}, qr/\bemail\b/, "Response contains the default scopes" );
|
like( $json->{scope}, qr/\bemail\b/, "Response contains the default scopes" );
|
||||||
unlike( $json->{scope}, qr/\bwrite\b/, "Response omits a dynamic scope that evaluates to false" );
|
unlike( $json->{scope}, qr/\bwrite\b/,
|
||||||
unlike( $json->{scope}, qr/\bifrequested\b/, "Response omits a dynamic scope that was not requested" );
|
"Response omits a dynamic scope that evaluates to false" );
|
||||||
like( $json->{scope}, qr/\bread\b/, "Response contains a dynamic scope that is sent only when requested" );
|
unlike( $json->{scope}, qr/\bifrequested\b/,
|
||||||
like( $json->{scope}, qr/\balways\b/, "Response contains a dynamic scope that is not requested but always sent" );
|
"Response omits a dynamic scope that was not requested" );
|
||||||
is ($token_resp_scope, $json->{scope}, "Token response scope matches token scope");
|
like( $json->{scope}, qr/\bread\b/,
|
||||||
|
"Response contains a dynamic scope that is sent only when requested" );
|
||||||
|
like( $json->{scope}, qr/\balways\b/,
|
||||||
|
"Response contains a dynamic scope that is not requested but always sent" );
|
||||||
|
unlike( $json->{scope}, qr/\bunknown\b/,
|
||||||
|
"Response omits a scope that is not declared anywhere" );
|
||||||
|
like( $json->{scope}, qr/\bextrascope\b/,
|
||||||
|
"Response contains scope coming from extra claims definition" );
|
||||||
|
is( $token_resp_scope, $json->{scope},
|
||||||
|
"Token response scope matches token scope" );
|
||||||
|
|
||||||
# Check status after expiration
|
# Check status after expiration
|
||||||
Time::Fake->offset("+2h");
|
Time::Fake->offset("+2h");
|
||||||
|
|
Loading…
Reference in New Issue
Block a user