From 7b1571b0ed8db7e7f235e09807d2b1828c1bb1ec Mon Sep 17 00:00:00 2001 From: Jonathan Perret Date: Mon, 18 Aug 2025 15:26:03 +0200 Subject: [PATCH 1/4] =?UTF-8?q?=E2=9C=85(e2e)=20fix=20e2e=20test=20to=20mo?= =?UTF-8?q?re=20reliably=20select=20test=20IdP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The list of IdPs on the RENATER test federation seems to have grown enough that the test IdP we want is no longer displayed by default, so we have to search for it. --- src/satosa/tests/test_e2e.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/satosa/tests/test_e2e.py b/src/satosa/tests/test_e2e.py index 20ab6fa..1635864 100644 --- a/src/satosa/tests/test_e2e.py +++ b/src/satosa/tests/test_e2e.py @@ -20,6 +20,7 @@ def renater_test_idp(page, login): def renater_wayf(page): page.get_by_text("Veuillez sélectionner").click() + page.get_by_role("searchbox").fill("GIP RENATER - IdP de test") page.get_by_role("option", name="GIP RENATER - IdP de test", exact=True).click() page.get_by_role("button", name="Sélection").click() From a8bf8f61b4a22837a421550266fe2f94b0265e0d Mon Sep 17 00:00:00 2001 From: Jonathan Perret Date: Wed, 17 Sep 2025 15:27:54 +0200 Subject: [PATCH 2/4] =?UTF-8?q?=F0=9F=90=9B(oidc)=20stop=20forcing=20id=5F?= =?UTF-8?q?token=20'acr'=20claim?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit There is a regression in pyop 3.4.2 which causes the configured extra_id_token_claims to be ignored. Fortunately, ProConnect Core now requests the required `acr` claim explicitly, so it is no longer necessary to force it. The OIDC test client was updated to request the `acr` claim in the same way that ProConnect does it. --- CHANGELOG.md | 3 +++ docker/oidc-test-client/app.py | 6 ++---- src/satosa/plugins/frontends/openid_connect_frontend.yaml | 5 ----- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b7796f3..0ba047b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## Unreleased +- include ACR claim in ID token only if requested (#32) + ## [1.0.8] - 2025-09-10 - fix secrets submodule path following move to `proconnect-gouv` organization - update other references to `numerique-gouv` organization diff --git a/docker/oidc-test-client/app.py b/docker/oidc-test-client/app.py index 201a4db..d6ac74c 100644 --- a/docker/oidc-test-client/app.py +++ b/docker/oidc-test-client/app.py @@ -2,13 +2,10 @@ from flask import Flask, jsonify, request, session from oic.oic import Client from oic.utils.authn.client import CLIENT_AUTHN_METHOD from oic import rndstr -from oic.oic.message import RegistrationResponse +from oic.oic.message import Claims, ClaimsRequest, RegistrationResponse from oic.utils.http_util import Redirect from oic.oic.message import AuthorizationResponse import secrets -import webbrowser -import threading -import time import logging import os @@ -52,6 +49,7 @@ def index(): "nonce": session["nonce"], "redirect_uri": client.registration_response["redirect_uris"][0], "state": session["state"], + "claims": ClaimsRequest(id_token=Claims(acr=None, amr=None)), } ) login_url = auth_req.request(client.authorization_endpoint) diff --git a/src/satosa/plugins/frontends/openid_connect_frontend.yaml b/src/satosa/plugins/frontends/openid_connect_frontend.yaml index 8bf9d66..9505bad 100644 --- a/src/satosa/plugins/frontends/openid_connect_frontend.yaml +++ b/src/satosa/plugins/frontends/openid_connect_frontend.yaml @@ -56,8 +56,3 @@ config: - given_name usual_name: - usual_name - extra_id_token_claims: - oidc-test-client: - - acr - agent-connect: - - acr From a56ce17b3477c7dc3b7c7e3b8d1361123a24594d Mon Sep 17 00:00:00 2001 From: Jonathan Perret Date: Wed, 17 Sep 2025 15:23:47 +0200 Subject: [PATCH 3/4] =?UTF-8?q?=E2=AC=86=EF=B8=8F(oidc-test-client)=20upgr?= =?UTF-8?q?ade=20oic=20to=201.7.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This mainly avoids a conflict with the oidc2fer requirements when installing both in a local virtualenv for IDE support. --- docker/oidc-test-client/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/oidc-test-client/requirements.txt b/docker/oidc-test-client/requirements.txt index 7ee47b1..9651550 100644 --- a/docker/oidc-test-client/requirements.txt +++ b/docker/oidc-test-client/requirements.txt @@ -1,2 +1,2 @@ Flask==3.0.3 -oic==1.6.1 +oic==1.7.0 From 9a33149e9e114146ddbf5aaa661cc4055f050df7 Mon Sep 17 00:00:00 2001 From: Jonathan Perret Date: Wed, 17 Sep 2025 15:50:45 +0200 Subject: [PATCH 4/4] =?UTF-8?q?=E2=9C=85(e2e)=20adapt=20to=20ProConnect=20?= =?UTF-8?q?error=20page=20wording=20change?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The generic message was replaced by the error code and description from the IdP. --- src/satosa/tests/test_e2e.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/satosa/tests/test_e2e.py b/src/satosa/tests/test_e2e.py index 1635864..cef255d 100644 --- a/src/satosa/tests/test_e2e.py +++ b/src/satosa/tests/test_e2e.py @@ -126,7 +126,7 @@ def test_pro_connect_to_renater_student_not_allowed(page: Page): renater_wayf(page) renater_test_idp(page, login="etudiant1") - expect(page.locator("body")).to_contain_text("Une erreur technique est survenue.") + expect(page.locator("body")).to_contain_text("access_denied") @pytest.mark.skipif(