You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1128 lines
43 KiB
1128 lines
43 KiB
/*
|
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
* the license and the contributors participating to this project.
|
|
*/
|
|
|
|
using System.Net.Http;
|
|
using System.Security.Claims;
|
|
using System.Threading;
|
|
using System.Threading.Tasks;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using Moq;
|
|
using OpenIddict.Abstractions;
|
|
using Xunit;
|
|
using static OpenIddict.Abstractions.OpenIddictConstants;
|
|
using static OpenIddict.Server.OpenIddictServerEvents;
|
|
using static OpenIddict.Server.OpenIddictServerHandlers;
|
|
using static OpenIddict.Server.OpenIddictServerHandlers.Revocation;
|
|
|
|
namespace OpenIddict.Server.FunctionalTests
|
|
{
|
|
public abstract partial class OpenIddictServerIntegrationTests
|
|
{
|
|
[Theory]
|
|
[InlineData(nameof(HttpMethod.Delete))]
|
|
[InlineData(nameof(HttpMethod.Get))]
|
|
[InlineData(nameof(HttpMethod.Head))]
|
|
[InlineData(nameof(HttpMethod.Options))]
|
|
[InlineData(nameof(HttpMethod.Put))]
|
|
[InlineData(nameof(HttpMethod.Trace))]
|
|
public async Task ExtractRevocationRequest_UnexpectedMethodReturnsAnError(string method)
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options => options.EnableDegradedMode());
|
|
|
|
// Act
|
|
var response = await client.SendAsync(method, "/connect/revoke", new OpenIddictRequest());
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidRequest, response.Error);
|
|
Assert.Equal("The specified HTTP method is not valid.", response.ErrorDescription);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("custom_error", null, null)]
|
|
[InlineData("custom_error", "custom_description", null)]
|
|
[InlineData("custom_error", "custom_description", "custom_uri")]
|
|
[InlineData(null, "custom_description", null)]
|
|
[InlineData(null, "custom_description", "custom_uri")]
|
|
[InlineData(null, null, "custom_uri")]
|
|
[InlineData(null, null, null)]
|
|
public async Task ExtractRevocationRequest_AllowsRejectingRequest(string error, string description, string uri)
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ExtractRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Reject(error, description, uri);
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest());
|
|
|
|
// Assert
|
|
Assert.Equal(error ?? Errors.InvalidRequest, response.Error);
|
|
Assert.Equal(description, response.ErrorDescription);
|
|
Assert.Equal(uri, response.ErrorUri);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ExtractRevocationRequest_AllowsHandlingResponse()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ExtractRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Transaction.SetProperty("custom_response", new
|
|
{
|
|
name = "Bob le Bricoleur"
|
|
});
|
|
|
|
context.HandleRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest());
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Bricoleur", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ExtractRevocationRequest_AllowsSkippingHandler()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ExtractRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.SkipRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest());
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Magnifique", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_MissingTokenCausesAnError()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options => options.EnableDegradedMode());
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = null
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidRequest, response.Error);
|
|
Assert.Equal("The mandatory 'token' parameter is missing.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_AccessTokenCausesAnUnsupportedTokenTypeErrorWhenReferenceTokensAreDisabled()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken)
|
|
.SetAudiences("AdventureWorks")
|
|
.SetPresenters("Contoso");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "2YotnFZFEjr1zCsicMWpAA",
|
|
TokenTypeHint = TokenTypeHints.AccessToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.UnsupportedTokenType, response.Error);
|
|
Assert.Equal("The specified token cannot be revoked.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_IdentityTokenCausesAnUnsupportedTokenTypeError()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.IdToken)
|
|
.SetAudiences("AdventureWorks");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "2YotnFZFEjr1zCsicMWpAA",
|
|
TokenTypeHint = TokenTypeHints.IdToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.UnsupportedTokenType, response.Error);
|
|
Assert.Equal("This token cannot be revoked.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_AuthorizationCodeCausesAnErrorWhenCallerIsNotAValidPresenter()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("SlAV32hkKG", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AuthorizationCode)
|
|
.SetPresenters("Contoso");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.AuthorizationCode
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidToken, response.Error);
|
|
Assert.Equal("The client application is not allowed to revoke the specified token.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_AccessTokenCausesAnErrorWhenCallerIsNotAValidAudienceOrPresenter()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken)
|
|
.SetAudiences("AdventureWorks")
|
|
.SetPresenters("Contoso");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "2YotnFZFEjr1zCsicMWpAA",
|
|
TokenTypeHint = TokenTypeHints.AccessToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidToken, response.Error);
|
|
Assert.Equal("The client application is not allowed to revoke the specified token.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_RefreshTokenCausesAnErrorWhenCallerIsNotAValidPresenter()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("8xLOxBtZp8", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.RefreshToken)
|
|
.SetPresenters("Contoso");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "8xLOxBtZp8",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidToken, response.Error);
|
|
Assert.Equal("The client application is not allowed to revoke the specified token.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_RequestWithoutClientIdIsRejectedWhenClientIdentificationIsRequired()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Configure(options => options.AcceptAnonymousClients = false);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidRequest, response.Error);
|
|
Assert.Equal("The mandatory 'client_id' parameter is missing.", response.ErrorDescription);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_RequestIsRejectedWhenClientCannotBeFound()
|
|
{
|
|
// Arrange
|
|
var manager = CreateApplicationManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(value: null);
|
|
});
|
|
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidClient, response.Error);
|
|
Assert.Equal("The specified 'client_id' parameter is invalid.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_RequestIsRejectedWhenEndpointPermissionIsNotGranted()
|
|
{
|
|
// Arrange
|
|
var application = new OpenIddictApplication();
|
|
|
|
var manager = CreateApplicationManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(application);
|
|
|
|
mock.Setup(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(ClientTypes.Public);
|
|
|
|
mock.Setup(manager => manager.HasPermissionAsync(application,
|
|
Permissions.Endpoints.Revocation, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(false);
|
|
});
|
|
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Services.AddSingleton(manager);
|
|
|
|
builder.Configure(options => options.IgnoreEndpointPermissions = false);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.UnauthorizedClient, response.Error);
|
|
Assert.Equal("This client application is not allowed to use the revocation endpoint.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.HasPermissionAsync(application,
|
|
Permissions.Endpoints.Revocation, It.IsAny<CancellationToken>()), Times.Once());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_ClientSecretCannotBeUsedByPublicClients()
|
|
{
|
|
// Arrange
|
|
var application = new OpenIddictApplication();
|
|
|
|
var manager = CreateApplicationManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(application);
|
|
|
|
mock.Setup(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(ClientTypes.Public);
|
|
});
|
|
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
ClientSecret = "7Fjfp0ZBr1KtDRbnfVdmIw",
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidRequest, response.Error);
|
|
Assert.Equal("The 'client_secret' parameter is not valid for this client application.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()), Times.Once());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_ClientSecretIsRequiredForConfidentialClients()
|
|
{
|
|
// Arrange
|
|
var application = new OpenIddictApplication();
|
|
|
|
var manager = CreateApplicationManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(application);
|
|
|
|
mock.Setup(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(ClientTypes.Confidential);
|
|
});
|
|
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
ClientSecret = null,
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidClient, response.Error);
|
|
Assert.Equal("The 'client_secret' parameter required for this client application is missing.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()), Times.Once());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_ClientSecretIsRequiredForHybridClients()
|
|
{
|
|
// Arrange
|
|
var application = new OpenIddictApplication();
|
|
|
|
var manager = CreateApplicationManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(application);
|
|
|
|
mock.Setup(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(ClientTypes.Hybrid);
|
|
});
|
|
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
ClientSecret = null,
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidClient, response.Error);
|
|
Assert.Equal("The 'client_secret' parameter required for this client application is missing.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()), Times.Once());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_RequestIsRejectedWhenClientCredentialsAreInvalid()
|
|
{
|
|
// Arrange
|
|
var application = new OpenIddictApplication();
|
|
|
|
var manager = CreateApplicationManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(application);
|
|
|
|
mock.Setup(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(ClientTypes.Confidential);
|
|
|
|
mock.Setup(manager => manager.ValidateClientSecretAsync(application, "7Fjfp0ZBr1KtDRbnfVdmIw", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(false);
|
|
});
|
|
|
|
var client = CreateClient(builder =>
|
|
{
|
|
builder.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
ClientId = "Fabrikam",
|
|
ClientSecret = "7Fjfp0ZBr1KtDRbnfVdmIw",
|
|
Token = "SlAV32hkKG",
|
|
TokenTypeHint = TokenTypeHints.RefreshToken
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidClient, response.Error);
|
|
Assert.Equal("The specified client credentials are invalid.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByClientIdAsync("Fabrikam", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.GetClientTypeAsync(application, It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.ValidateClientSecretAsync(application, "7Fjfp0ZBr1KtDRbnfVdmIw", It.IsAny<CancellationToken>()), Times.Once());
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("custom_error", null, null)]
|
|
[InlineData("custom_error", "custom_description", null)]
|
|
[InlineData("custom_error", "custom_description", "custom_uri")]
|
|
[InlineData(null, "custom_description", null)]
|
|
[InlineData(null, "custom_description", "custom_uri")]
|
|
[InlineData(null, null, "custom_uri")]
|
|
[InlineData(null, null, null)]
|
|
public async Task ValidateRevocationRequest_AllowsRejectingRequest(string error, string description, string uri)
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<ValidateRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Reject(error, description, uri);
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(error ?? Errors.InvalidRequest, response.Error);
|
|
Assert.Equal(description, response.ErrorDescription);
|
|
Assert.Equal(uri, response.ErrorUri);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_AllowsHandlingResponse()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<ValidateRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Transaction.SetProperty("custom_response", new
|
|
{
|
|
name = "Bob le Bricoleur"
|
|
});
|
|
|
|
context.HandleRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Bricoleur", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateRevocationRequest_AllowsSkippingHandler()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<ValidateRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.SkipRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Magnifique", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task HandleRevocationRequest_TokenIsNotRevokedWhenItIsUnknown()
|
|
{
|
|
// Arrange
|
|
var manager = CreateTokenManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByIdAsync("3E228451-1555-46F7-A471-951EFBA23A56", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(value: null);
|
|
});
|
|
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("SlAV32hkKG", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.RefreshToken)
|
|
.SetInternalTokenId("3E228451-1555-46F7-A471-951EFBA23A56");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
|
|
options.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "SlAV32hkKG"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidToken, response.Error);
|
|
Assert.Equal("The specified token is invalid.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByIdAsync("3E228451-1555-46F7-A471-951EFBA23A56", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.TryRevokeAsync(It.IsAny<OpenIddictToken>(), It.IsAny<CancellationToken>()), Times.Never());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task HandleRevocationRequest_TokenIsNotRevokedWhenItIsAlreadyRevoked()
|
|
{
|
|
// Arrange
|
|
var token = new OpenIddictToken();
|
|
|
|
var manager = CreateTokenManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByIdAsync("3E228451-1555-46F7-A471-951EFBA23A56", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(token);
|
|
|
|
mock.Setup(manager => manager.GetIdAsync(token, It.IsAny<CancellationToken>()))
|
|
.Returns(new ValueTask<string>("3E228451-1555-46F7-A471-951EFBA23A56"));
|
|
|
|
mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Valid, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(false);
|
|
|
|
mock.Setup(manager => manager.GetTypeAsync(token, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(TokenTypeHints.RefreshToken);
|
|
});
|
|
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("SlAV32hkKG", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.RefreshToken)
|
|
.SetInternalTokenId("3E228451-1555-46F7-A471-951EFBA23A56");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
|
|
options.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "SlAV32hkKG"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(Errors.InvalidToken, response.Error);
|
|
Assert.Equal("The specified token is no longer valid.", response.ErrorDescription);
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByIdAsync("3E228451-1555-46F7-A471-951EFBA23A56", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.TryRevokeAsync(It.IsAny<OpenIddictToken>(), It.IsAny<CancellationToken>()), Times.Never());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task HandleRevocationRequest_TokenIsSuccessfullyRevoked()
|
|
{
|
|
// Arrange
|
|
var token = new OpenIddictToken();
|
|
|
|
var manager = CreateTokenManager(mock =>
|
|
{
|
|
mock.Setup(manager => manager.FindByIdAsync("3E228451-1555-46F7-A471-951EFBA23A56", It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(token);
|
|
|
|
mock.Setup(manager => manager.GetIdAsync(token, It.IsAny<CancellationToken>()))
|
|
.Returns(new ValueTask<string>("3E228451-1555-46F7-A471-951EFBA23A56"));
|
|
|
|
mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Valid, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(true);
|
|
|
|
mock.Setup(manager => manager.GetTypeAsync(token, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(TokenTypeHints.RefreshToken);
|
|
|
|
mock.Setup(manager => manager.TryRevokeAsync(token, It.IsAny<CancellationToken>()))
|
|
.ReturnsAsync(true);
|
|
});
|
|
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("SlAV32hkKG", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.RefreshToken)
|
|
.SetInternalTokenId("3E228451-1555-46F7-A471-951EFBA23A56");
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.RemoveEventHandler(NormalizeErrorResponse.Descriptor);
|
|
|
|
options.Services.AddSingleton(manager);
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "SlAV32hkKG"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Empty(response.GetParameters());
|
|
|
|
Mock.Get(manager).Verify(manager => manager.FindByIdAsync("3E228451-1555-46F7-A471-951EFBA23A56", It.IsAny<CancellationToken>()), Times.AtLeastOnce());
|
|
Mock.Get(manager).Verify(manager => manager.TryRevokeAsync(token, It.IsAny<CancellationToken>()), Times.Once());
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("custom_error", null, null)]
|
|
[InlineData("custom_error", "custom_description", null)]
|
|
[InlineData("custom_error", "custom_description", "custom_uri")]
|
|
[InlineData(null, "custom_description", null)]
|
|
[InlineData(null, "custom_description", "custom_uri")]
|
|
[InlineData(null, null, "custom_uri")]
|
|
[InlineData(null, null, null)]
|
|
public async Task HandleRevocationRequest_AllowsRejectingRequest(string error, string description, string uri)
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<HandleRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Reject(error, description, uri);
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal(error ?? Errors.InvalidRequest, response.Error);
|
|
Assert.Equal(description, response.ErrorDescription);
|
|
Assert.Equal(uri, response.ErrorUri);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task HandleRevocationRequest_AllowsHandlingResponse()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<HandleRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Transaction.SetProperty("custom_response", new
|
|
{
|
|
name = "Bob le Bricoleur"
|
|
});
|
|
|
|
context.HandleRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Bricoleur", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task HandleRevocationRequest_AllowsSkippingHandler()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<HandleRevocationRequestContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.SkipRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Magnifique", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyRevocationResponse_AllowsHandlingResponse()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
options.UseReferenceAccessTokens();
|
|
|
|
options.AddEventHandler<ProcessAuthenticationContext>(builder =>
|
|
{
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
Assert.Equal("2YotnFZFEjr1zCsicMWpAA", context.Token);
|
|
|
|
context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
|
|
.SetTokenType(TokenTypeHints.AccessToken);
|
|
|
|
return default;
|
|
});
|
|
|
|
builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
|
|
});
|
|
|
|
options.AddEventHandler<ApplyRevocationResponseContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Transaction.SetProperty("custom_response", new
|
|
{
|
|
name = "Bob le Bricoleur"
|
|
});
|
|
|
|
context.HandleRequest();
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal("Bob le Bricoleur", (string) response["name"]);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyRevocationResponse_ResponseContainsCustomParameters()
|
|
{
|
|
// Arrange
|
|
var client = CreateClient(options =>
|
|
{
|
|
options.EnableDegradedMode();
|
|
|
|
options.AddEventHandler<ApplyRevocationResponseContext>(builder =>
|
|
builder.UseInlineHandler(context =>
|
|
{
|
|
context.Response["custom_parameter"] = "custom_value";
|
|
context.Response["parameter_with_multiple_values"] = new[]
|
|
{
|
|
"custom_value_1",
|
|
"custom_value_2"
|
|
};
|
|
|
|
return default;
|
|
}));
|
|
});
|
|
|
|
// Act
|
|
var response = await client.PostAsync("/connect/revoke", new OpenIddictRequest
|
|
{
|
|
Token = "2YotnFZFEjr1zCsicMWpAA"
|
|
});
|
|
|
|
// Assert
|
|
Assert.Equal("custom_value", (string) response["custom_parameter"]);
|
|
Assert.Equal(new[] { "custom_value_1", "custom_value_2" }, (string[]) response["parameter_with_multiple_values"]);
|
|
}
|
|
}
|
|
}
|
|
|