526 lines
21 KiB
Python
526 lines
21 KiB
Python
# -*- coding: utf-8 -*-
|
|
# authentic2 - versatile identity manager
|
|
# Copyright (C) 2010-2019 Entr'ouvert
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
import datetime
|
|
import os
|
|
import pytest
|
|
import json
|
|
import time
|
|
import random
|
|
|
|
from jwcrypto.jwk import JWKSet, JWK
|
|
from jwcrypto.jwt import JWT
|
|
from jwcrypto.jws import JWS, InvalidJWSObject
|
|
from jwcrypto.common import base64url_encode, base64url_decode, json_encode
|
|
|
|
from httmock import urlmatch, HTTMock
|
|
|
|
from django.utils.timezone import utc
|
|
from django.core.urlresolvers import reverse
|
|
from django.contrib.auth import get_user_model
|
|
from django.utils.timezone import now
|
|
from django.utils.six.moves.urllib import parse as urlparse
|
|
|
|
from django_rbac.utils import get_ou_model
|
|
|
|
from authentic2_auth_oidc.utils import (parse_id_token, IDToken, get_providers,
|
|
has_providers, register_issuer, IDTokenError)
|
|
from authentic2_auth_oidc.models import OIDCProvider, OIDCClaimMapping
|
|
from authentic2.models import AttributeValue
|
|
from authentic2.utils import timestamp_from_datetime, last_authentication_event
|
|
from authentic2.a2_rbac.utils import get_default_ou
|
|
|
|
import utils
|
|
|
|
pytestmark = pytest.mark.django_db
|
|
|
|
|
|
def test_base64url_decode():
|
|
with pytest.raises(ValueError):
|
|
base64url_decode('x')
|
|
base64url_decode('aa')
|
|
|
|
header_rsa_decoded = {'alg': 'RS256', 'kid': '1e9gdk7'}
|
|
header_hmac_decoded = {'alg': 'HS256'}
|
|
payload_decoded = {
|
|
'sub': '248289761001',
|
|
'iss': 'http://server.example.com',
|
|
'aud': 's6BhdRkqt3',
|
|
'nonce': 'n-0S6_WzA2Mj',
|
|
'iat': 1311280970,
|
|
'exp': 2201094278,
|
|
}
|
|
header_rsa = 'eyJhbGciOiJSUzI1NiIsImtpZCI6IjFlOWdkazcifQ'
|
|
header_hmac = 'eyJhbGciOiJIUzI1NiJ9'
|
|
payload = ('eyJhdWQiOiJzNkJoZFJrcXQzIiwiZXhwIjoyMjAxMDk0Mjc4LCJpYXQiOjEzMTEyOD'
|
|
'A5NzAsImlzcyI6Imh0dHA6Ly9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJub25jZSI6Im4t'
|
|
'MFM2X1d6QTJNaiIsInN1YiI6IjI0ODI4OTc2MTAwMSJ9')
|
|
|
|
|
|
def test_parse_id_token(code, oidc_provider, oidc_provider_jwkset, header,
|
|
signature):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code):
|
|
with pytest.raises(InvalidJWSObject):
|
|
parse_id_token('x%s.%s.%s' % (header, payload, signature), oidc_provider)
|
|
with pytest.raises(InvalidJWSObject):
|
|
parse_id_token('%s.%s.%s' % ('$', payload, signature), oidc_provider)
|
|
with pytest.raises(InvalidJWSObject):
|
|
parse_id_token('%s.x%s.%s' % (header, payload, signature), oidc_provider)
|
|
with pytest.raises(InvalidJWSObject):
|
|
parse_id_token('%s.%s.%s' % (header, '$', signature), oidc_provider)
|
|
with pytest.raises(InvalidJWSObject):
|
|
parse_id_token('%s.%s.%s' % (header, payload, '-'), oidc_provider)
|
|
assert parse_id_token('%s.%s.%s' % (header, payload, signature), oidc_provider)
|
|
|
|
|
|
def test_idtoken(oidc_provider, header, signature):
|
|
token = IDToken('%s.%s.%s' % (header, payload, signature))
|
|
token.deserialize(oidc_provider)
|
|
assert token.sub == payload_decoded['sub']
|
|
assert token.iss == payload_decoded['iss']
|
|
assert token.aud == payload_decoded['aud']
|
|
assert token.nonce == payload_decoded['nonce']
|
|
assert token.iat == datetime.datetime(2011, 7, 21, 20, 42, 50, tzinfo=utc)
|
|
assert token.exp == datetime.datetime(2039, 10, 1, 15, 4, 38, tzinfo=utc)
|
|
|
|
|
|
@pytest.fixture
|
|
def oidc_provider_jwkset():
|
|
key = JWK.generate(kty='RSA', size=512, kid='1e9gdk7')
|
|
jwkset = JWKSet()
|
|
jwkset.add(key)
|
|
return jwkset
|
|
|
|
OIDC_PROVIDER_PARAMS = [
|
|
{},
|
|
{
|
|
'idtoken_algo': OIDCProvider.ALGO_HMAC
|
|
},
|
|
{
|
|
'claims_parameter_supported': True,
|
|
}
|
|
]
|
|
|
|
|
|
@pytest.fixture(params=OIDC_PROVIDER_PARAMS)
|
|
def oidc_provider(request, db, oidc_provider_jwkset):
|
|
idtoken_algo = request.param.get('idtoken_algo', OIDCProvider.ALGO_RSA)
|
|
claims_parameter_supported = request.param.get('claims_parameter_supported', False)
|
|
from authentic2_auth_oidc.utils import get_provider, get_provider_by_issuer
|
|
get_provider.cache.clear()
|
|
get_provider_by_issuer.cache.clear()
|
|
if idtoken_algo == OIDCProvider.ALGO_RSA:
|
|
jwkset = json.loads(oidc_provider_jwkset.export())
|
|
else:
|
|
jwkset = None
|
|
provider = OIDCProvider.objects.create(
|
|
ou=get_default_ou(),
|
|
name='OIDIDP',
|
|
issuer='http://server.example.com',
|
|
authorization_endpoint='https://server.example.com/authorize',
|
|
token_endpoint='https://server.example.com/token',
|
|
end_session_endpoint='https://server.example.com/logout',
|
|
userinfo_endpoint='https://server.example.com/user_info',
|
|
token_revocation_endpoint='https://server.example.com/revoke',
|
|
max_auth_age=10,
|
|
strategy=OIDCProvider.STRATEGY_CREATE,
|
|
jwkset_json=jwkset,
|
|
idtoken_algo=idtoken_algo,
|
|
claims_parameter_supported=claims_parameter_supported,
|
|
)
|
|
provider.full_clean()
|
|
OIDCClaimMapping.objects.create(
|
|
provider=provider,
|
|
claim='sub',
|
|
attribute='username',
|
|
idtoken_claim=True)
|
|
OIDCClaimMapping.objects.create(
|
|
provider=provider,
|
|
claim='email',
|
|
attribute='email')
|
|
OIDCClaimMapping.objects.create(
|
|
provider=provider,
|
|
claim='email',
|
|
required=True,
|
|
attribute='email')
|
|
OIDCClaimMapping.objects.create(
|
|
provider=provider,
|
|
claim='given_name',
|
|
required=True,
|
|
verified=OIDCClaimMapping.ALWAYS_VERIFIED,
|
|
attribute='first_name')
|
|
OIDCClaimMapping.objects.create(
|
|
provider=provider,
|
|
claim='family_name',
|
|
required=True,
|
|
verified=OIDCClaimMapping.VERIFIED_CLAIM,
|
|
attribute='last_name')
|
|
OIDCClaimMapping.objects.create(
|
|
provider=provider,
|
|
claim='ou',
|
|
attribute='ou__slug')
|
|
return provider
|
|
|
|
|
|
@pytest.fixture
|
|
def code():
|
|
return 'xxxx'
|
|
|
|
|
|
@pytest.fixture
|
|
def header(oidc_provider):
|
|
if oidc_provider.idtoken_algo == OIDCProvider.ALGO_RSA:
|
|
return header_rsa
|
|
elif oidc_provider.idtoken_algo == OIDCProvider.ALGO_HMAC:
|
|
return header_hmac
|
|
|
|
|
|
@pytest.fixture
|
|
def signature(oidc_provider):
|
|
if oidc_provider.idtoken_algo == OIDCProvider.ALGO_RSA:
|
|
key = oidc_provider.jwkset.get_key(kid='1e9gdk7')
|
|
header_decoded = header_rsa_decoded
|
|
elif oidc_provider.idtoken_algo == OIDCProvider.ALGO_HMAC:
|
|
key = JWK(kty='oct', k=base64url_encode(
|
|
oidc_provider.client_secret.encode('utf-8')))
|
|
header_decoded = header_hmac_decoded
|
|
jws = JWS(payload=json_encode(payload_decoded))
|
|
jws.add_signature(key=key, protected=header_decoded)
|
|
return json.loads(jws.serialize())['signature']
|
|
|
|
|
|
def oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code, extra_id_token=None,
|
|
extra_user_info=None, sub='john.doe', nonce=None):
|
|
token_endpoint = urlparse.urlparse(oidc_provider.token_endpoint)
|
|
userinfo_endpoint = urlparse.urlparse(oidc_provider.userinfo_endpoint)
|
|
token_revocation_endpoint = urlparse.urlparse(oidc_provider.token_revocation_endpoint)
|
|
|
|
@urlmatch(netloc=token_endpoint.netloc, path=token_endpoint.path)
|
|
def token_endpoint_mock(url, request):
|
|
if urlparse.parse_qs(request.body).get('code') == [code]:
|
|
id_token = {
|
|
'iss': oidc_provider.issuer,
|
|
'sub': sub,
|
|
'iat': timestamp_from_datetime(now()),
|
|
'aud': str(oidc_provider.client_id),
|
|
'exp': timestamp_from_datetime(now() + datetime.timedelta(seconds=10)),
|
|
}
|
|
if nonce:
|
|
id_token['nonce'] = nonce
|
|
if extra_id_token:
|
|
id_token.update(extra_id_token)
|
|
|
|
if oidc_provider.idtoken_algo == OIDCProvider.ALGO_RSA:
|
|
jwt = JWT(header={'alg': 'RS256', 'kid': '1e9gdk7'},
|
|
claims=id_token)
|
|
jwt.make_signed_token(list(oidc_provider_jwkset['keys'])[0])
|
|
else:
|
|
jwt = JWT(header={'alg': 'HS256'},
|
|
claims=id_token)
|
|
k = base64url_encode(oidc_provider.client_secret.encode('utf-8'))
|
|
jwt.make_signed_token(
|
|
JWK(kty='oct',
|
|
k=k.decode('ascii')))
|
|
|
|
content = {
|
|
'access_token': '1234',
|
|
# check token_type is case insensitive
|
|
'token_type': random.choice(['B', 'b']) + 'earer',
|
|
'id_token': jwt.serialize(),
|
|
}
|
|
return {
|
|
'content': json.dumps(content),
|
|
'headers': {
|
|
'content-type': 'application/json',
|
|
},
|
|
'status_code': 200,
|
|
}
|
|
else:
|
|
return {
|
|
'content': json.dumps({'error': 'invalid request'}),
|
|
'headers': {
|
|
'content-type': 'application/json',
|
|
},
|
|
'status_code': 400,
|
|
}
|
|
|
|
@urlmatch(netloc=userinfo_endpoint.netloc, path=userinfo_endpoint.path)
|
|
def user_info_endpoint_mock(url, request):
|
|
user_info = {
|
|
'sub': sub,
|
|
'iss': oidc_provider.issuer,
|
|
'given_name': 'John',
|
|
'family_name': 'Doe',
|
|
'email': 'john.doe@example.com',
|
|
}
|
|
if extra_user_info:
|
|
user_info.update(extra_user_info)
|
|
return {
|
|
'content': json.dumps(user_info),
|
|
'headers': {
|
|
'content-type': 'application/json',
|
|
},
|
|
'status_code': 200,
|
|
}
|
|
|
|
@urlmatch(netloc=token_revocation_endpoint.netloc, path=token_revocation_endpoint.path)
|
|
def token_revocation_endpoint_mock(url, request):
|
|
query = urlparse.parse_qs(request.body)
|
|
assert 'token' in query
|
|
return {
|
|
'status_code': 200,
|
|
}
|
|
return HTTMock(token_endpoint_mock, user_info_endpoint_mock, token_revocation_endpoint_mock)
|
|
|
|
|
|
@pytest.fixture
|
|
def login_url(oidc_provider):
|
|
return reverse('oidc-login', kwargs={'pk': oidc_provider.pk})
|
|
|
|
|
|
@pytest.fixture
|
|
def login_callback_url(oidc_provider):
|
|
return reverse('oidc-login-callback')
|
|
|
|
|
|
def check_simple_qs(qs):
|
|
for k in qs:
|
|
assert len(qs[k]) == 1
|
|
qs[k] = qs[k][0]
|
|
return qs
|
|
|
|
|
|
def test_sso(app, caplog, code, oidc_provider, oidc_provider_jwkset, login_url, login_callback_url, hooks):
|
|
OU = get_ou_model()
|
|
cassis = OU.objects.create(name='Cassis', slug='cassis')
|
|
OU.cached.cache.clear()
|
|
|
|
response = app.get('/admin/').maybe_follow()
|
|
assert oidc_provider.name in response.text
|
|
response = response.click(oidc_provider.name)
|
|
location = urlparse.urlparse(response.location)
|
|
endpoint = urlparse.urlparse(oidc_provider.authorization_endpoint)
|
|
assert location.scheme == endpoint.scheme
|
|
assert location.netloc == endpoint.netloc
|
|
assert location.path == endpoint.path
|
|
query = check_simple_qs(urlparse.parse_qs(location.query))
|
|
assert query['state'] in app.session['auth_oidc']
|
|
assert query['response_type'] == 'code'
|
|
assert query['client_id'] == str(oidc_provider.client_id)
|
|
assert query['scope'] == 'openid'
|
|
assert query['redirect_uri'] == 'http://testserver' + reverse('oidc-login-callback')
|
|
# get the nonce
|
|
nonce = app.session['auth_oidc'][query['state']]['request']['nonce']
|
|
|
|
if oidc_provider.claims_parameter_supported:
|
|
claims = json.loads(query['claims'])
|
|
assert claims['id_token']['sub'] is None
|
|
assert claims['userinfo']['email']['essential']
|
|
assert claims['userinfo']['given_name']['essential']
|
|
assert claims['userinfo']['family_name']['essential']
|
|
assert claims['userinfo']['ou'] is None
|
|
|
|
User = get_user_model()
|
|
assert User.objects.count() == 0
|
|
|
|
with utils.check_log(caplog, 'failed to contact the token_endpoint'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code):
|
|
response = app.get(login_callback_url, params={'code': 'yyyy', 'state': query['state']})
|
|
with utils.check_log(caplog, 'invalid id_token %r'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_id_token={'iss': None}):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
with utils.check_log(caplog, 'invalid id_token %r'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_id_token={'sub': None}):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
with utils.check_log(caplog, 'authentication is too old'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_id_token={'iat': 1}):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
with utils.check_log(caplog, 'invalid id_token %r'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_id_token={'exp': 1}):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
with utils.check_log(caplog, 'invalid id_token audience'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_id_token={'aud': 'zz'}):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
with utils.check_log(caplog, 'expected nonce'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
assert not hooks.auth_oidc_backend_modify_user
|
|
with utils.check_log(caplog, 'created user'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code, nonce=nonce):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
assert len(hooks.auth_oidc_backend_modify_user) == 1
|
|
assert set(hooks.auth_oidc_backend_modify_user[0]['kwargs']) >= set(['user', 'provider', 'user_info', 'id_token', 'access_token'])
|
|
assert urlparse.urlparse(response['Location']).path == '/admin/'
|
|
assert User.objects.count() == 1
|
|
user = User.objects.get()
|
|
assert user.ou == get_default_ou()
|
|
assert user.username == 'john.doe'
|
|
assert user.first_name == 'John'
|
|
assert user.last_name == 'Doe'
|
|
assert user.email == 'john.doe@example.com'
|
|
assert user.attributes.first_name == 'John'
|
|
assert user.attributes.last_name == 'Doe'
|
|
assert AttributeValue.objects.filter(content='John', verified=True).count() == 1
|
|
assert AttributeValue.objects.filter(content='Doe', verified=False).count() == 1
|
|
assert last_authentication_event(session=app.session)['nonce'] == nonce
|
|
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_user_info={'family_name_verified': True}, nonce=nonce):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
assert AttributeValue.objects.filter(content='Doe', verified=False).count() == 0
|
|
assert AttributeValue.objects.filter(content='Doe', verified=True).count() == 1
|
|
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code,
|
|
extra_user_info={'ou': 'cassis'}, nonce=nonce):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
assert User.objects.count() == 1
|
|
user = User.objects.get()
|
|
assert user.ou == cassis
|
|
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code, nonce=nonce):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
assert User.objects.count() == 1
|
|
user = User.objects.get()
|
|
assert user.ou == get_default_ou()
|
|
last_modified = user.modified
|
|
|
|
time.sleep(0.1)
|
|
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
assert User.objects.count() == 1
|
|
user = User.objects.get()
|
|
assert user.ou == get_default_ou()
|
|
assert user.modified == last_modified
|
|
|
|
response = app.get(reverse('account_management'))
|
|
with utils.check_log(caplog, 'revoked token from OIDC'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code):
|
|
response = response.click(href='logout')
|
|
assert response.location.startswith('https://server.example.com/logout?')
|
|
|
|
|
|
def test_show_on_login_page(app, oidc_provider):
|
|
# we have a 5 seconds cache on list of providers, we have to work around it
|
|
get_providers.cache.clear()
|
|
has_providers.cache.clear()
|
|
response = app.get('/login/')
|
|
assert 'oidc-a-oididp' in response.text
|
|
|
|
# do not show this provider on login page anymore
|
|
oidc_provider.show = False
|
|
oidc_provider.save()
|
|
|
|
# we have a 5 seconds cache on list of providers, we have to work around it
|
|
get_providers.cache.clear()
|
|
has_providers.cache.clear()
|
|
response = app.get('/login/')
|
|
assert 'oidc-a-oididp' not in response.text
|
|
|
|
|
|
def test_strategy_find_uuid(app, caplog, code, oidc_provider, oidc_provider_jwkset, login_url,
|
|
login_callback_url, simple_user):
|
|
|
|
get_providers.cache.clear()
|
|
has_providers.cache.clear()
|
|
# no mapping please
|
|
OIDCClaimMapping.objects.all().delete()
|
|
oidc_provider.strategy = oidc_provider.STRATEGY_FIND_UUID
|
|
oidc_provider.save()
|
|
|
|
User = get_user_model()
|
|
assert User.objects.count() == 1
|
|
|
|
response = app.get('/').maybe_follow()
|
|
assert oidc_provider.name in response.text
|
|
response = response.click(oidc_provider.name)
|
|
location = urlparse.urlparse(response.location)
|
|
query = check_simple_qs(urlparse.parse_qs(location.query))
|
|
nonce = app.session['auth_oidc'][query['state']]['request']['nonce']
|
|
|
|
# sub=john.doe, MUST not work
|
|
with utils.check_log(caplog, 'cannot create user'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code, nonce=nonce):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
|
|
# sub=simple_user.uuid MUST work
|
|
with utils.check_log(caplog, 'found user using UUID'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code, sub=simple_user.uuid, nonce=nonce):
|
|
response = app.get(login_callback_url, params={'code': code, 'state': query['state']})
|
|
|
|
assert urlparse.urlparse(response['Location']).path == '/'
|
|
assert User.objects.count() == 1
|
|
user = User.objects.get()
|
|
# verify user was not modified
|
|
assert user.username == 'user'
|
|
assert user.first_name == u'Jôhn'
|
|
assert user.last_name == u'Dôe'
|
|
assert user.email == 'user@example.net'
|
|
assert user.attributes.first_name == u'Jôhn'
|
|
assert user.attributes.last_name == u'Dôe'
|
|
|
|
response = app.get(reverse('account_management'))
|
|
with utils.check_log(caplog, 'revoked token from OIDC'):
|
|
with oidc_provider_mock(oidc_provider, oidc_provider_jwkset, code, nonce=nonce):
|
|
response = response.click(href='logout')
|
|
assert response.location.startswith('https://server.example.com/logout?')
|
|
|
|
|
|
def test_register_issuer(db, app, caplog, oidc_provider_jwkset):
|
|
config_dir = os.path.dirname(__file__)
|
|
config_file = os.path.join(config_dir, 'openid_configuration.json')
|
|
with open(config_file) as f:
|
|
oidc_conf = json.load(f)
|
|
jwks_uri = urlparse.urlparse(oidc_conf['jwks_uri'])
|
|
|
|
@urlmatch(netloc=jwks_uri.netloc, path=jwks_uri.path)
|
|
def jwks_mock(url, request):
|
|
return oidc_provider_jwkset.export()
|
|
|
|
with HTTMock(jwks_mock):
|
|
provider = register_issuer(
|
|
name='test_issuer',
|
|
issuer='https://default.issuer',
|
|
openid_configuration=oidc_conf)
|
|
|
|
oidc_conf['id_token_signing_alg_values_supported'] = ['HS256']
|
|
with HTTMock(jwks_mock):
|
|
provider = register_issuer(
|
|
name='test_issuer_hmac_only',
|
|
issuer='https://hmac_only.issuer',
|
|
openid_configuration=oidc_conf)
|
|
|
|
|
|
def test_required_keys(db, oidc_provider, header, signature, caplog):
|
|
erroneous_payload = base64url_encode(json.dumps({
|
|
'sub': '248289761001',
|
|
'iss': 'http://server.example.com',
|
|
'iat': 1311280970,
|
|
'exp': 1311281970, # Missing 'aud' and 'nonce' required claims
|
|
'extra_stuff': 'hi there', # Wrong claim
|
|
}))
|
|
|
|
with pytest.raises(IDTokenError):
|
|
with utils.check_log(caplog, 'missing field'):
|
|
token = IDToken('{}.{}.{}'.format(header, erroneous_payload, signature))
|
|
token.deserialize(oidc_provider)
|