public async Task Client_can_use_plain_code_challenge_method()
{
await _pipeline.LoginAsync("bob");
var nonce = Guid.NewGuid().ToString();
var code_challenge = code_verifier;
var authorizeResponse = await _pipeline.RequestAuthorizationEndpointAsync(client_id,
response_type,
Constants.StandardScopes.OpenId,
redirect_uri,
nonce : nonce,
codeChallenge : code_challenge,
codeChallengeMethod : OidcConstants.CodeChallengeMethods.Plain);
authorizeResponse.IsError.Should().BeFalse();
var code = authorizeResponse.Code;
var tokenClient = new TokenClient(MockIdSvrUiPipeline.TokenEndpoint, client_id, client_secret, _pipeline.Handler);
var tokenResponse = await tokenClient.RequestAuthorizationCodeAsync(code, redirect_uri, code_verifier);
tokenResponse.IsError.Should().BeFalse();
tokenResponse.TokenType.Should().Be("Bearer");
tokenResponse.AccessToken.Should().NotBeNull();
tokenResponse.IdentityToken.Should().NotBeNull();
tokenResponse.ExpiresIn.Should().BeGreaterThan(0);
}
public async Task Request_with_response_type_code_supported()
{
await _mockPipeline.LoginAsync("bob");
var metadata = await _mockPipeline.Client.GetAsync(MockIdSvrUiPipeline.DiscoveryEndpoint);
metadata.StatusCode.Should().Be(HttpStatusCode.OK);
var state = Guid.NewGuid().ToString();
var nonce = Guid.NewGuid().ToString();
var url = _mockPipeline.CreateAuthorizeUrl(
clientId: "code_client",
responseType: "code",
scope: "openid",
redirectUri: "https://code_client/callback",
state: state,
nonce: nonce);
var response = await _mockPipeline.BrowserClient.GetAsync(url);
response.StatusCode.Should().Be(HttpStatusCode.Found);
var authorization = new IdentityModel.Client.AuthorizeResponse(response.Headers.Location.ToString());
authorization.IsError.Should().BeFalse();
authorization.Code.Should().NotBeNull();
authorization.State.Should().Be(state);
}
public async Task get_request_should_redirect_to_configured_logout_path()
{
_mockPipeline.Options.UserInteractionOptions.LogoutUrl = "/logout";
_mockPipeline.Options.UserInteractionOptions.LogoutIdParameter = "id";
await _mockPipeline.LoginAsync(IdentityServerPrincipal.Create("bob", "Bob Loblaw"));
var url = _mockPipeline.CreateAuthorizeUrl(
clientId: "client1",
responseType: "id_token",
scope: "openid",
redirectUri: "https://client1/callback",
state: "123_state",
nonce: "123_nonce");
_mockPipeline.BrowserClient.AllowAutoRedirect = false;
var response = await _mockPipeline.BrowserClient.GetAsync(url);
var authorization = new IdentityModel.Client.AuthorizeResponse(response.Headers.Location.ToString());
var id_token = authorization.IdentityToken;
response = await _mockPipeline.BrowserClient.GetAsync(MockIdSvrUiPipeline.EndSessionEndpoint +
"?id_token_hint=" + id_token +
"&post_logout_redirect_uri=https://client1/signout-callback");
response.StatusCode.Should().Be(HttpStatusCode.Redirect);
response.Headers.Location.ToString().Should().StartWith("https://server/logout?id=");
}
public async Task client_requires_consent_should_show_consent_page()
{
await _mockPipeline.LoginAsync("bob");
var url = _mockPipeline.CreateAuthorizeUrl(
clientId: "client2",
responseType: "id_token",
scope: "openid",
redirectUri: "https://client2/callback",
state: "123_state",
nonce: "123_nonce"
);
var response = await _mockPipeline.BrowserClient.GetAsync(url);
_mockPipeline.ConsentWasCalled.Should().BeTrue();
}
public async Task Reject_redirect_uri_not_matching_registered_redirect_uri()
{
await _mockPipeline.LoginAsync("bob");
var nonce = Guid.NewGuid().ToString();
var state = Guid.NewGuid().ToString();
var url = _mockPipeline.CreateAuthorizeUrl(
clientId: "code_client",
responseType: "code",
scope: "openid",
redirectUri: "https://bad",
state: state,
nonce: nonce);
var response = await _mockPipeline.BrowserClient.GetAsync(url);
_mockPipeline.ErrorWasCalled.Should().BeTrue();
_mockPipeline.ErrorMessage.Error.Should().Be("unauthorized_client");
}
async Task <Tokens> GetTokensAsync()
{
await _mockPipeline.LoginAsync("bob");
var authorizationResponse = await _mockPipeline.RequestAuthorizationEndpointAsync(
client_id,
"code",
"api offline_access",
"https://client/callback");
authorizationResponse.IsError.Should().BeFalse();
authorizationResponse.Code.Should().NotBeNull();
var tokenClient = new TokenClient(MockIdSvrUiPipeline.TokenEndpoint, client_id, client_secret, _mockPipeline.Handler);
var tokenResponse = await tokenClient.RequestAuthorizationCodeAsync(authorizationResponse.Code, redirect_uri);
tokenResponse.IsError.Should().BeFalse();
tokenResponse.AccessToken.Should().NotBeNull();
tokenResponse.RefreshToken.Should().NotBeNull();
return(new Tokens(tokenResponse));
}
public async Task Unrestricted_implicit_client_can_request_IdToken()
{
await _mockPipeline.LoginAsync(_user);
var url = _mockPipeline.CreateAuthorizeUrl("client1",
"id_token", "openid", "https://client1/callback", "state", "nonce");
_mockPipeline.BrowserClient.AllowAutoRedirect = false;
var response = await _mockPipeline.BrowserClient.GetAsync(url);
response.StatusCode.Should().Be(HttpStatusCode.Found);
response.Headers.Location.AbsoluteUri.Should().StartWith("https://client1/callback");
var authorization = new IdentityModel.Client.AuthorizeResponse(response.Headers.Location.ToString());
authorization.IdentityToken.Should().NotBeNull();
authorization.AccessToken.Should().BeNull();
}
public async Task Token_endpoint_supports_client_authentication_with_basic_authentication_with_POST()
{
await _pipeline.LoginAsync("bob");
var nonce = Guid.NewGuid().ToString();
_pipeline.BrowserClient.AllowAutoRedirect = false;
var url = _pipeline.CreateAuthorizeUrl(
clientId: "code_pipeline.Client",
responseType: "code",
scope: "openid",
redirectUri: "https://code_pipeline.Client/callback?foo=bar&baz=quux",
nonce: nonce);
var response = await _pipeline.BrowserClient.GetAsync(url);
var authorization = _pipeline.ParseAuthorizationResponseUrl(response.Headers.Location.ToString());
authorization.Code.Should().NotBeNull();
var code = authorization.Code;
// backchannel client
var wrapper = new MessageHandlerWrapper(_pipeline.Handler);
var tokenClient = new TokenClient(MockIdSvrUiPipeline.TokenEndpoint, "code_pipeline.Client", "secret", wrapper);
var tokenResult = await tokenClient.RequestAuthorizationCodeAsync(code, "https://code_pipeline.Client/callback?foo=bar&baz=quux");
tokenResult.IsError.Should().BeFalse();
tokenResult.HttpErrorReason.Should().BeNull();
tokenResult.TokenType.Should().Be("Bearer");
tokenResult.AccessToken.Should().NotBeNull();
tokenResult.ExpiresIn.Should().BeGreaterThan(0);
tokenResult.IdentityToken.Should().NotBeNull();
wrapper.Response.Headers.CacheControl.NoCache.Should().BeTrue();
wrapper.Response.Headers.CacheControl.NoStore.Should().BeTrue();
}
public async Task authenticated_user_with_valid_request_should_receive_authorization_response()
{
await _mockPipeline.LoginAsync("bob");
_mockPipeline.BrowserClient.AllowAutoRedirect = false;
var url = _mockPipeline.CreateAuthorizeUrl(
clientId: "client1",
responseType: "id_token",
scope: "openid",
redirectUri: "https://client1/callback",
state: "123_state",
nonce: "123_nonce");
var response = await _mockPipeline.BrowserClient.GetAsync(url);
response.StatusCode.Should().Be(HttpStatusCode.Redirect);
response.Headers.Location.ToString().Should().StartWith("https://client1/callback");
var authorization = new IdentityModel.Client.AuthorizeResponse(response.Headers.Location.ToString());
authorization.IsError.Should().BeFalse();
authorization.IdentityToken.Should().NotBeNull();
authorization.State.Should().Be("123_state");
}
public async Task session_id_should_be_reissued_if_session_cookie_absent()
{
await _mockPipeline.LoginAsync("bob");
var sid1 = _mockPipeline.GetSessionCookie().Value;
sid1.Should().NotBeNull();
_mockPipeline.RemoveSessionCookie();
await _mockPipeline.BrowserClient.GetAsync(MockIdSvrUiPipeline.DiscoveryEndpoint);
var sid2 = _mockPipeline.GetSessionCookie().Value;
sid2.Should().Be(sid1);
}
public async Task valid_request_to_federated_signout_endpoint_should_render_page_with_iframe()
{
await _pipeline.LoginAsync(_user);
var response = await _pipeline.BrowserClient.GetAsync(MockIdSvrUiPipeline.FederatedSignOutUrl + "?sid=123");
response.StatusCode.Should().Be(HttpStatusCode.OK);
response.Content.Headers.ContentType.MediaType.Should().Be("text/html");
var html = await response.Content.ReadAsStringAsync();
html.Should().Contain(_idSvrIFrameUrl);
}
public async Task valid_request_to_federated_signout_endpoint_should_render_page_with_iframe()
{
await _pipeline.LoginAsync(_user);
await _pipeline.RequestAuthorizationEndpointAsync(
clientId : "client1",
responseType : "id_token",
scope : "openid",
redirectUri : "https://client1/callback",
state : "123_state",
nonce : "123_nonce");
var response = await _pipeline.BrowserClient.GetAsync(MockIdSvrUiPipeline.FederatedSignOutUrl + "?sid=123");
response.StatusCode.Should().Be(HttpStatusCode.OK);
response.Content.Headers.ContentType.MediaType.Should().Be("text/html");
var html = await response.Content.ReadAsStringAsync();
html.Should().Contain("https://server/connect/endsession/callback?endSessionId=");
}
public async Task Client_cannot_use_plain_code_challenge_method()
{
await _pipeline.LoginAsync("bob");
var nonce = Guid.NewGuid().ToString();
var code_challenge = code_verifier;
var authorizeResponse = await _pipeline.RequestAuthorizationEndpointAsync(client_id,
response_type,
IdentityServerConstants.StandardScopes.OpenId,
redirect_uri,
nonce : nonce,
codeChallenge : code_challenge,
codeChallengeMethod : OidcConstants.CodeChallengeMethods.Plain);
_pipeline.ErrorWasCalled.Should().BeTrue();
_pipeline.ErrorMessage.Error.Should().Be(OidcConstants.AuthorizeErrors.InvalidRequest);
}