Skip to content

Native auth: Add new E2E test for authentication context MFA, Fixes AB#3117220 #2252

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nilo-ms merged 2 commits into from
Feb 6, 2025
Merged

Native auth: Add new E2E test for authentication context MFA, Fixes AB#3117220 #2252

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d0f46a4
Add new E2E test for authentication context MFA
nilo-ms Feb 4, 2025
f61f9f3
use existing MFA config
nilo-ms Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletions ...src/test/java/com/microsoft/identity/client/e2e/tests/network/nativeauth/SignInMFATest.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,13 @@

package com.microsoft.identity.client.e2e.tests.network.nativeauth

import com.microsoft.identity.client.claims.ClaimsRequest
import com.microsoft.identity.client.e2e.utils.assertResult
import com.microsoft.identity.internal.testutils.nativeauth.ConfigType
import com.microsoft.identity.internal.testutils.nativeauth.api.TemporaryEmailService
import com.microsoft.identity.internal.testutils.nativeauth.api.models.NativeAuthTestConfig
import com.microsoft.identity.nativeauth.INativeAuthPublicClientApplication
import com.microsoft.identity.nativeauth.parameters.NativeAuthSignInParameters
import com.microsoft.identity.nativeauth.statemachine.errors.MFASubmitChallengeError
import com.microsoft.identity.nativeauth.statemachine.results.GetAccessTokenResult
import com.microsoft.identity.nativeauth.statemachine.results.MFARequiredResult
Expand All @@ -36,8 +38,10 @@ import kotlinx.coroutines.runBlocking
import org.junit.Assert.assertEquals
import org.junit.Assert.assertNotNull
import org.junit.Assert.assertTrue
import org.junit.Assert.fail
import org.junit.Ignore
import org.junit.Test
import java.util.Base64

class SignInMFATest : NativeAuthPublicClientApplicationAbstractTest() {

Expand Down Expand Up @@ -258,4 +262,72 @@ class SignInMFATest : NativeAuthPublicClientApplicationAbstractTest() {
}
}
}

/**
* Full flow:
* - SignIn specifying authentication context as claim
* - Receive MFA required error from API.
* - Request default challenge.
* - Submit correct challenge.
* - Complete MFA flow and complete sign in.
* - Check that access token contains authentication context claim.
*
*/
@Ignore("Retrieving OTP code failure and missing AC username")
@Test
fun `test MFA flow is triggered when authentication context is used as claim`() {
config = getConfig(ConfigType.SIGN_IN_MFA_SINGLE_AUTH)
application = setupPCA(config, defaultChallengeTypes)
resources = config.resources
val authenticationContextId = "c4"
val authenticationContextRequestClaimJson = "{\"access_token\":{\"acrs\":{\"essential\":true,\"value\":\"$authenticationContextId\"}}}"
val authenticationContextATClaimJson = "\"acrs\":[\"$authenticationContextId\"]"

retryOperation {
runBlocking {
val username = config.email
val password = getSafePassword()
val params = NativeAuthSignInParameters(username)
params.password = password.toCharArray()
params.claimsRequest = ClaimsRequest.getClaimsRequestFromJsonString(authenticationContextRequestClaimJson)

val result = application.signIn(params)
assertResult<SignInResult.MFARequired>(result)

// Initiate challenge, send code to email
val sendChallengeResult =
(result as SignInResult.MFARequired).nextState.requestChallenge()
assertResult<MFARequiredResult.VerificationRequired>(sendChallengeResult)
(sendChallengeResult as MFARequiredResult.VerificationRequired)
assertNotNull(sendChallengeResult.sentTo)
assertNotNull(sendChallengeResult.codeLength)
assertNotNull(sendChallengeResult.channel)

// Retrieve challenge from mailbox and submit
val otp = tempEmailApi.retrieveCodeFromInbox(username)
val submitCorrectChallengeResult = sendChallengeResult.nextState.submitChallenge(otp)
assertResult<SignInResult.Complete>(submitCorrectChallengeResult)

// Retrieve access token
val accountState = (submitCorrectChallengeResult as SignInResult.Complete).resultValue
val getAccessTokenResult = accountState.getAccessToken()
assertResult<GetAccessTokenResult.Complete>(getAccessTokenResult)
val authResult = (getAccessTokenResult as GetAccessTokenResult.Complete).resultValue

// Check that AT contains authentication context claim
val atParts = authResult.accessToken.split(".")
if (atParts.size != 3) {
fail("Invalid Access token received")
return@runBlocking
}
val atBody = atParts[1]
val charset = charset("UTF-8")
val atDecoded = String(
Base64.getUrlDecoder().decode(atBody.toByteArray(charset)),
charset
)
assertTrue(atDecoded.contains(authenticationContextATClaimJson))
}
}
}
}