Skip to content

Add IAL and AAL to token response #7782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jeremy1026 merged 26 commits into from
Feb 16, 2023
Merged

Add IAL and AAL to token response #7782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
832d0ff
[skip changelog]
Jeremy1026 Jan 25, 2023
d3ff5d1
[skip changelog]
Jeremy1026 Jan 30, 2023
0abe32f
changelog: additional clean up
Jeremy1026 Jan 30, 2023
c6913ad
changelog: Improvements, OpenID Connect Add ial and aal to userinfo r…
Jeremy1026 Feb 7, 2023
b906b7d
Use the existing constants
Jeremy1026 Feb 7, 2023
55e954b
Merge branch 'main' into jcurcio/lg-8704-add-ial-and-aal-to-userinfo-…
Jeremy1026 Feb 7, 2023
d4bbc41
Add default AAL value
Jeremy1026 Feb 7, 2023
8b221f3
With default values, don’t need to verify presence
Jeremy1026 Feb 7, 2023
780be4f
Lint cleanup
Jeremy1026 Feb 7, 2023
0348f5c
does need a blank line
Jeremy1026 Feb 7, 2023
0a51dbf
Update spec to expect URL instead of int
Jeremy1026 Feb 7, 2023
de0e998
Add feature flag for IAL and AAL in OIDC response
Jeremy1026 Feb 9, 2023
55b48bf
Merge branch 'main' into jcurcio/lg-8704-add-ial-and-aal-to-userinfo-…
Jeremy1026 Feb 9, 2023
eaf1d0f
Clean ups
Jeremy1026 Feb 9, 2023
a58da23
Remove feature flag gating
Jeremy1026 Feb 13, 2023
a206e15
Remove migration
Jeremy1026 Feb 15, 2023
a2cb484
If nil, use default
Jeremy1026 Feb 15, 2023
b8617b1
Shorten the line length for lint
Jeremy1026 Feb 15, 2023
bef3710
Revert schema from my local, un-merged migration
Jeremy1026 Feb 15, 2023
5c2ae1f
move default to openid_connect_authorize_form
Jeremy1026 Feb 15, 2023
023a7e4
Rework for lint
Jeremy1026 Feb 15, 2023
09f76ed
Remove extra line
Jeremy1026 Feb 15, 2023
031d5b8
Add tests for ial and aal in userinfo
Jeremy1026 Feb 15, 2023
381629b
Add specs for defaul aal and aal+ial in same acr
Jeremy1026 Feb 16, 2023
96af05d
Shorten lines to make lint :)
Jeremy1026 Feb 16, 2023
ae573b6
Another lint fix
Jeremy1026 Feb 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion app/forms/openid_connect_authorize_form.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,8 @@ def aal_values
end

def aal
Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[aal_values.sort.max]
Saml::Idp::Constants::AUTHN_CONTEXT_CLASSREF_TO_AAL[aal_values.sort.max] ||
Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF
end

def_delegators :ial_context,
Expand Down
2 changes: 2 additions & 0 deletions app/presenters/openid_connect_user_info_presenter.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ def user_info
info.merge!(ial2_attributes) if scoper.ial2_scopes_requested?
info.merge!(x509_attributes) if scoper.x509_scopes_requested?
info[:verified_at] = verified_at if scoper.verified_at_requested?
info[:ial] = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
info[:aal] = Saml::Idp::Constants::AUTHN_CONTEXT_AAL_TO_CLASSREF[identity.aal]

scoper.filter(info)
end
Expand Down
92 changes: 92 additions & 0 deletions spec/forms/openid_connect_authorize_form_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -356,6 +356,98 @@
end
end

describe '#aal' do
context 'when DEFAULT_AAL passed' do
before do
default = Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF
IdentityConfig.store.valid_authn_contexts.push(default)
end

after do
IdentityConfig.store.valid_authn_contexts.pop
end

let(:acr_values) { Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF }

it 'returns 0' do
expect(form.aal).to eq(Saml::Idp::Constants::DEFAULT_AAL_AUTHN_CONTEXT_CLASSREF)
end
end

context 'when AAL1 passed' do

@orenyk orenyk Feb 15, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: I don't think we need to test for this since we don't support it

@orenyk orenyk Feb 15, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, this should probably be replaced with a test for the default AAL specification instead of AAL1

@Jeremy1026 Jeremy1026 Feb 16, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any harm in keeping checking 1? A couple extra cycles, and an extra second per test run?

@orenyk orenyk Feb 16, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nah not really, other than the setup where you modify the allowed aal values feeling a bit weird to me. Either way is fine by me!

before do
aal1 = Saml::Idp::Constants::AAL1_AUTHN_CONTEXT_CLASSREF
IdentityConfig.store.valid_authn_contexts.push(aal1)
end

after do
IdentityConfig.store.valid_authn_contexts.pop
end

let(:acr_values) { Saml::Idp::Constants::AAL1_AUTHN_CONTEXT_CLASSREF }

it 'returns 1' do
expect(form.aal).to eq(1)
end
end

context 'when AAL2 passed' do
let(:acr_values) { Saml::Idp::Constants::AAL2_AUTHN_CONTEXT_CLASSREF }
Comment thread
Jeremy1026 marked this conversation as resolved.

it 'returns 2' do
expect(form.aal).to eq(2)
end
end

context 'when AAL2_PHISHING_RESISTANT passed' do
let(:acr_values) { Saml::Idp::Constants::AAL2_PHISHING_RESISTANT_AUTHN_CONTEXT_CLASSREF }

it 'returns 2' do
expect(form.aal).to eq(2)
end
end

context 'when AAL2_HSPD12 passed' do
let(:acr_values) { Saml::Idp::Constants::AAL2_HSPD12_AUTHN_CONTEXT_CLASSREF }

it 'returns 2' do
expect(form.aal).to eq(2)
end
end

context 'when AAL3 passed' do
let(:acr_values) { Saml::Idp::Constants::AAL3_AUTHN_CONTEXT_CLASSREF }

it 'returns 3' do
expect(form.aal).to eq(3)
end
end

context 'when AAL3_HSPD12 passed' do
let(:acr_values) { Saml::Idp::Constants::AAL3_HSPD12_AUTHN_CONTEXT_CLASSREF }

it 'returns 3' do
expect(form.aal).to eq(3)
end
end
end

describe '#aal' do
context 'when IAL and AAL passed' do
aal2 = Saml::Idp::Constants::AAL2_AUTHN_CONTEXT_CLASSREF
ial2 = Saml::Idp::Constants::IAL2_AUTHN_CONTEXT_CLASSREF

let(:acr_values) do
"#{aal2} #{ial2}"
end

it 'returns ial and aal' do
expect(form.aal).to eq(2)
expect(form.ial).to eq(2)
end
end
end

describe '#verified_within' do
context 'without a verified_within' do
let(:verified_within) { nil }
Expand Down
6 changes: 6 additions & 0 deletions spec/presenters/openid_connect_user_info_presenter_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
user: create(:user, profiles: [profile]),
service_provider: service_provider.issuer,
scope: scope,
aal: 2,
)
end

Expand All @@ -26,12 +27,17 @@
subject(:user_info) { presenter.user_info }

it 'has basic attributes' do
ial = Saml::Idp::Constants::AUTHN_CONTEXT_IAL_TO_CLASSREF[identity.ial]
aal = Saml::Idp::Constants::AUTHN_CONTEXT_AAL_TO_CLASSREF[identity.aal]

aggregate_failures do
expect(user_info[:sub]).to eq(identity.uuid)
expect(user_info[:iss]).to eq(root_url)
expect(user_info[:email]).to eq(identity.user.email_addresses.first.email)
expect(user_info[:email_verified]).to eq(true)
expect(user_info[:all_emails]).to eq([identity.user.email_addresses.first.email])
expect(user_info[:ial]).to eq(ial)
expect(user_info[:aal]).to eq(aal)
end
end

Expand Down