Skip to content

Commit b6f5270

Browse files
cicnavicicnavi
authored
Always Use single value for standard claims (#310)
1 parent be9cc74 commit b6f5270

File tree

3 files changed

+154
-32
lines changed

3 files changed

+154
-32
lines changed

‎UPGRADE.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,22 @@
11

2+
# Version 6 to 7
3+
4+
## New features
5+
6+
## New configuration options
7+
8+
## Major impact changes
9+
- In v6 of the module, when defining custom scopes, there was a possibility to use standard claims with the
10+
'are_multiple_claim_values_allowed' option. This would allow multiple values (array of values) for standard
11+
claims which have a single value by specification. All
12+
[standard claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims)
13+
are now hardcoded to have single value, even when 'are_multiple_claim_values_allowed' option is enabled.
14+
15+
## Medium impact changes
16+
17+
## Low impact changes
18+
19+
220
# Version 5 to 6
321

422
## New features

‎src/Utils/ClaimTranslatorExtractor.php‎

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -130,26 +130,25 @@ class ClaimTranslatorExtractor
130130
*/
131131
final public const MANDATORY_SINGLE_VALUE_CLAIMS = [
132132
'sub',
133-
// TODO mivanci v7 Uncomment the rest of the claims, as this was a potential breaking change in v6.
134-
// 'name',
135-
// 'given_name',
136-
// 'family_name',
137-
// 'middle_name',
138-
// 'nickname',
139-
// 'preferred_username',
140-
// 'profile',
141-
// 'picture',
142-
// 'website',
143-
// 'email',
144-
// 'email_verified',
145-
// 'gender',
146-
// 'birthdate',
147-
// 'zoneinfo',
148-
// 'locale',
149-
// 'phone_number',
150-
// 'phone_number_verified',
151-
// 'address',
152-
// 'updated_at',
133+
'name',
134+
'given_name',
135+
'family_name',
136+
'middle_name',
137+
'nickname',
138+
'preferred_username',
139+
'profile',
140+
'picture',
141+
'website',
142+
'email',
143+
'email_verified',
144+
'gender',
145+
'birthdate',
146+
'zoneinfo',
147+
'locale',
148+
'phone_number',
149+
'phone_number_verified',
150+
'address',
151+
'updated_at',
153152
];
154153

155154
/**

‎tests/unit/src/Utils/ClaimTranslatorExtractorTest.php‎

Lines changed: 117 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -357,33 +357,138 @@ public function testWillReleaseSingleValueClaimsIfMultiValueNotAllowed(): void
357357

358358
public function testWillReleaseSingleValueClaimsForMandatorySingleValueClaims(): void
359359
{
360-
361-
// TODO mivanci v7 Test for mandatory single value claims in other scopes, as per
362-
// \SimpleSAML\Module\oidc\Utils\ClaimTranslatorExtractor::MANDATORY_SINGLE_VALUE_CLAIMS
363360
$claimSet = new ClaimSetEntity(
364-
'customScopeWithSubClaim',
365-
['sub'],
361+
'customScope',
362+
[
363+
'sub',
364+
'name',
365+
'given_name',
366+
'family_name',
367+
'middle_name',
368+
'nickname',
369+
'preferred_username',
370+
'profile',
371+
'picture',
372+
'website',
373+
'email',
374+
'email_verified',
375+
'gender',
376+
'birthdate',
377+
'zoneinfo',
378+
'locale',
379+
'phone_number',
380+
'phone_number_verified',
381+
'address',
382+
'updated_at',
383+
],
366384
);
367385

368386
$translate = [
369-
'sub' => [
370-
'subAttribute',
387+
'sub' => ['subAttribute'],
388+
'name' => ['nameAttribute'],
389+
'given_name' => ['givenNameAttribute'],
390+
'family_name' => ['familyNameAttribute'],
391+
'middle_name' => ['middleNameAttribute'],
392+
'nickname' => ['nicknameAttribute'],
393+
'preferred_username' => ['preferredUsernameAttribute'],
394+
'profile' => ['profileAttribute'],
395+
'picture' => ['pictureAttribute'],
396+
'website' => ['websiteAttribute'],
397+
'email' => ['emailAttribute'],
398+
'email_verified' => ['emailVerifiedAttribute'],
399+
'gender' => ['genderAttribute'],
400+
'birthdate' => ['birthdateAttribute'],
401+
'zoneinfo' => ['zoneinfoAttribute'],
402+
'locale' => ['localeAttribute'],
403+
'phone_number' => ['phoneNumberAttribute'],
404+
'phone_number_verified' => ['phoneNumberVerifiedAttribute'],
405+
'address' => [
406+
'type' => 'json',
407+
'claims' => [
408+
'formatted' => ['addressAttribute'],
409+
],
371410
],
411+
'updated_at' => ['updatedAtAttribute'],
372412
];
373413

374414
$userAttributes = [
375-
'subAttribute' => ['1', '2', '3'],
415+
'subAttribute' => ['id1', 'id2', 'id3'],
416+
'nameAttribute' => ['name1', 'name2', 'name3'],
417+
'givenNameAttribute' => ['givenName1', 'givenName2', 'givenName3'],
418+
'familyNameAttribute' => ['familyName1', 'familyName2', 'familyName3'],
419+
'middleNameAttribute' => ['middleName1', 'middleName2', 'middleName3'],
420+
'nicknameAttribute' => ['nickname1', 'nickname2', 'nickname3'],
421+
'preferredUsernameAttribute' => ['preferredUsername1', 'preferredUsername2', 'preferredUsername3'],
422+
'profileAttribute' => ['profileUrl1', 'profileUrl2', 'profileUrl3'],
423+
'pictureAttribute' => ['pictureUrl1', 'pictureUrl2', 'pictureUrl3'],
424+
'websiteAttribute' => ['websiteUrl1', 'websiteUrl2', 'websiteUrl3'],
425+
'emailAttribute' => ['email1', 'email2', 'email3'],
426+
'emailVerifiedAttribute' => [true, false],
427+
'genderAttribute' => ['gender1', 'gender2', 'gender3'],
428+
'birthdateAttribute' => ['birthdate1', 'birthdate2', 'birthdate3'],
429+
'zoneinfoAttribute' => ['zoneinfo1', 'zoneinfo2', 'zoneinfo3'],
430+
'localeAttribute' => ['locale1', 'locale2', 'locale3'],
431+
'phoneNumberAttribute' => ['phoneNumber1', 'phoneNumber2', 'phoneNumber3'],
432+
'phoneNumberVerifiedAttribute' => [true, false],
433+
'addressAttribute' => ['address1', 'address2', 'address3'],
434+
'updatedAtAttribute' => [123, 456],
376435
];
377436

378-
$claimTranslator = $this->mock([$claimSet], $translate, ['sub']);
437+
$claimTranslator = $this->mock(
438+
[$claimSet],
439+
$translate,
440+
[
441+
'sub',
442+
'name',
443+
'given_name',
444+
'family_name',
445+
'middle_name',
446+
'nickname',
447+
'preferred_username',
448+
'profile',
449+
'picture',
450+
'website',
451+
'email',
452+
'email_verified',
453+
'gender',
454+
'birthdate',
455+
'zoneinfo',
456+
'locale',
457+
'phone_number',
458+
'phone_number_verified',
459+
'address',
460+
'updated_at',
461+
],
462+
);
379463

380464
$releasedClaims = $claimTranslator->extract(
381-
['openid'],
465+
['customScope'],
382466
$userAttributes,
383467
);
384468

385-
$expectedClaims = ['sub' => '1'];
469+
$expectedClaims = [
470+
'sub' => 'id1',
471+
'name' => 'name1',
472+
'given_name' => 'givenName1',
473+
'family_name' => 'familyName1',
474+
'middle_name' => 'middleName1',
475+
'nickname' => 'nickname1',
476+
'preferred_username' => 'preferredUsername1',
477+
'profile' => 'profileUrl1',
478+
'picture' => 'pictureUrl1',
479+
'website' => 'websiteUrl1',
480+
'email' => 'email1',
481+
'email_verified' => true,
482+
'gender' => 'gender1',
483+
'birthdate' => 'birthdate1',
484+
'zoneinfo' => 'zoneinfo1',
485+
'locale' => 'locale1',
486+
'phone_number' => 'phoneNumber1',
487+
'phone_number_verified' => true,
488+
'address' => ['formatted' => 'address1'],
489+
'updated_at' => 123,
490+
];
386491

387-
$this->assertSame($expectedClaims, $releasedClaims);
492+
$this->assertEquals($expectedClaims, $releasedClaims);
388493
}
389494
}

0 commit comments

Comments
 (0)