From b38fc7b040a8f13719fb5fb9a293504d28aa99ca Mon Sep 17 00:00:00 2001 From: Sergei Maertens Date: Thu, 5 Sep 2024 17:17:03 +0200 Subject: [PATCH 1/2] :test_tube: [#4627] Add regression test for failing check constraint --- .../tests/test_auth_flow_callbacks.py | 32 ++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py b/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py index f427806bbb..decdd30192 100644 --- a/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py +++ b/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py @@ -11,16 +11,18 @@ to bring up a Keycloak instance. """ -from django.test import tag +from django.test import override_settings, tag import requests from furl import furl +from rest_framework.reverse import reverse from openforms.accounts.tests.factories import StaffUserFactory from openforms.authentication.constants import FORM_AUTH_SESSION_KEY from openforms.authentication.tests.utils import URLsHelper from openforms.authentication.views import BACKEND_OUTAGE_RESPONSE_PARAMETER from openforms.forms.tests.factories import FormFactory +from openforms.submissions.models import Submission from openforms.utils.tests.feature_flags import enable_feature_flag from openforms.utils.tests.keycloak import keycloak_login @@ -172,6 +174,34 @@ def test_failure_with_missing_acting_subject_claim(self): self.assertEqual(callback_response.request.url, url_helper.frontend_start) + # assert that we can start a submission + with ( + self.subTest("submission start"), + override_settings( + ALLOWED_HOSTS=["*"], + CORS_ALLOWED_ORIGINS=["http://testserver.com"], + ), + ): + api_path = reverse("api:form-detail", kwargs={"uuid_or_slug": form.uuid}) + # make sure csrf cookie is set + form_detail_response = self.app.get(api_path) + body = { + "form": f"http://testserver.com{api_path}", + "formUrl": "http://testserver.com/my-form", + } + + response = self.app.post_json( + reverse("api:submission-list"), + body, + extra_environ={ + "HTTP_X_CSRFTOKEN": form_detail_response.headers["X-CSRFToken"], + }, + ) + + self.assertEqual(response.status_code, 201) + submission = Submission.objects.get() + self.assertTrue(submission.is_authenticated) + @mock_eherkenning_config(legal_subject_claim=["absent-claim"]) def test_failing_claim_verification(self): form = FormFactory.create(authentication_backends=["eherkenning_oidc"]) From 48bc1fe6675153e7549e1e8e30069b1625ff591d Mon Sep 17 00:00:00 2001 From: Sergei Maertens Date: Thu, 5 Sep 2024 17:25:53 +0200 Subject: [PATCH 2/2] :ambulance: [#4627] Fix crash due to non-empty check constraint when no acting subject ID is provided Since this is an opaque ID anyway, we instead fall back to a dummy value if strict mode is disabled. --- .../contrib/digid_eherkenning_oidc/plugin.py | 18 +- ...sing_acting_subject_claim_strict_mode.yaml | 371 ++++++++++++++++++ .../tests/test_auth_flow_callbacks.py | 16 + 3 files changed, 402 insertions(+), 3 deletions(-) create mode 100644 src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/data/vcr_cassettes/EHerkenningCallbackTests/EHerkenningCallbackTests.test_failure_with_missing_acting_subject_claim_strict_mode.yaml diff --git a/src/openforms/authentication/contrib/digid_eherkenning_oidc/plugin.py b/src/openforms/authentication/contrib/digid_eherkenning_oidc/plugin.py index 46023dbd21..7971b40bc3 100644 --- a/src/openforms/authentication/contrib/digid_eherkenning_oidc/plugin.py +++ b/src/openforms/authentication/contrib/digid_eherkenning_oidc/plugin.py @@ -11,6 +11,7 @@ from django.utils.translation import gettext_lazy as _ from digid_eherkenning.oidc.models import BaseConfig +from flags.state import flag_enabled from mozilla_django_oidc_db.utils import do_op_logout from mozilla_django_oidc_db.views import _RETURN_URL_SESSION_KEY @@ -210,6 +211,18 @@ def get_logo(self, request) -> LoginLogo | None: return LoginLogo(title=self.get_label(), **get_eherkenning_logo(request)) def transform_claims(self, normalized_claims: EHClaims) -> FormAuth: + acting_subject_identifier_value = normalized_claims.get( + "acting_subject_claim", "" + ) + strict_mode = flag_enabled("DIGID_EHERKENNING_OIDC_STRICT") + + if strict_mode and not acting_subject_identifier_value: + raise ValueError( + "The acting_subject_claim value must be set to a non-empty value in " + "strict mode. You may have to contact your identity provider to ensure " + "it is present in the OIDC claims." + ) + form_auth: FormAuth = { "plugin": self.identifier, # TODO: look at `identifier_type_claim` and return kvk or rsin accordingly. @@ -219,9 +232,8 @@ def transform_claims(self, normalized_claims: EHClaims) -> FormAuth: "value": normalized_claims["legal_subject_claim"], "loa": str(normalized_claims.get("loa_claim", "")), "acting_subject_identifier_type": "opaque", - "acting_subject_identifier_value": normalized_claims.get( - "acting_subject_claim", "" - ), + "acting_subject_identifier_value": acting_subject_identifier_value + or "dummy-set-by@openforms", } if service_restriction := normalized_claims.get("branch_number_claim", ""): form_auth["legal_subject_service_restriction"] = service_restriction diff --git a/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/data/vcr_cassettes/EHerkenningCallbackTests/EHerkenningCallbackTests.test_failure_with_missing_acting_subject_claim_strict_mode.yaml b/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/data/vcr_cassettes/EHerkenningCallbackTests/EHerkenningCallbackTests.test_failure_with_missing_acting_subject_claim_strict_mode.yaml new file mode 100644 index 0000000000..5858acd339 --- /dev/null +++ b/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/data/vcr_cassettes/EHerkenningCallbackTests/EHerkenningCallbackTests.test_failure_with_missing_acting_subject_claim_strict_mode.yaml @@ -0,0 +1,371 @@ +interactions: +- request: + body: null + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Connection: + - keep-alive + User-Agent: + - python-requests/2.32.2 + method: GET + uri: http://localhost:8080/realms/test/protocol/openid-connect/auth + response: + body: + string: "\n\n\n\n \n + \ \n \n\n \n Sign + in to test\n \n \n \n \n \n \n\n\n\n
\n + \
\n
test
\n
\n
\n + \
\n

+ \ We are sorry...\n

\n
\n
\n + \
\n\n\n
\n + \

Invalid Request

\n
\n\n\n\n + \
\n
\n\n
\n
\n\n\n" + headers: + Content-Language: + - en + Content-Security-Policy: + - frame-src 'self'; frame-ancestors 'self'; object-src 'none'; + Content-Type: + - text/html;charset=utf-8 + Referrer-Policy: + - no-referrer + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-Frame-Options: + - SAMEORIGIN + X-Robots-Tag: + - none + X-XSS-Protection: + - 1; mode=block + content-length: + - '1573' + status: + code: 400 + message: Bad Request +- request: + body: null + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Connection: + - keep-alive + User-Agent: + - python-requests/2.32.2 + method: GET + uri: http://localhost:8080/realms/test/protocol/openid-connect/auth?response_type=code&scope=openid+kvk&client_id=testid&redirect_uri=http%3A%2F%2Ftestserver%2Feherkenning-oidc%2Fcallback%2F&state=not-a-random-string&nonce=not-a-random-string + response: + body: + string: "\n\n\n\n \n + \ \n \n\n \n Sign + in to test\n \n \n \n \n \n \n \n\n\n\n
\n + \
\n
test
\n
\n
\n + \
\n

+ \ Sign in to your account\n\n

\n
\n
\n + \
\n\n\n
\n + \
\n
\n
\n \n\n \n\n\n
\n\n
\n \n\n
\n + \ \n \n + \
\n\n\n
\n\n
\n
\n + \
\n
\n + \
\n\n
\n\n
\n \n \n
\n + \
\n
\n
\n \n\n\n\n\n\n + \
\n
\n\n
\n
\n\n\n" + headers: + Cache-Control: + - no-store, must-revalidate, max-age=0 + Content-Language: + - en + Content-Security-Policy: + - frame-src 'self'; frame-ancestors 'self'; object-src 'none'; + Content-Type: + - text/html;charset=utf-8 + Referrer-Policy: + - no-referrer + Set-Cookie: + - AUTH_SESSION_ID=cd960bc6-074c-45cf-8ceb-6416b368d6d2; Version=1; Path=/realms/test/; + SameSite=None; Secure; HttpOnly + - AUTH_SESSION_ID_LEGACY=cd960bc6-074c-45cf-8ceb-6416b368d6d2; Version=1; Path=/realms/test/; + HttpOnly + - KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlNzE1ZTA1MS02Y2RiLTQ4Y2MtYjRmNC1mMDcyMmM4MWY5ZDMifQ.eyJjaWQiOiJ0ZXN0aWQiLCJwdHkiOiJvcGVuaWQtY29ubmVjdCIsInJ1cmkiOiJodHRwOi8vdGVzdHNlcnZlci9laGVya2VubmluZy1vaWRjL2NhbGxiYWNrLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIGt2ayIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvdGVzdCIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwicmVkaXJlY3RfdXJpIjoiaHR0cDovL3Rlc3RzZXJ2ZXIvZWhlcmtlbm5pbmctb2lkYy9jYWxsYmFjay8iLCJzdGF0ZSI6Im5vdC1hLXJhbmRvbS1zdHJpbmciLCJub25jZSI6Im5vdC1hLXJhbmRvbS1zdHJpbmcifX0.SpI7JvuDjU8Dn4CR3RD56sJAxNizNRciRym82v57Ylo; + Version=1; Path=/realms/test/; HttpOnly + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-Frame-Options: + - SAMEORIGIN + X-Robots-Tag: + - none + X-XSS-Protection: + - 1; mode=block + content-length: + - '4466' + status: + code: 200 + message: OK +- request: + body: username=testuser&password=testuser&credentialId=&login=Sign+In + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Connection: + - keep-alive + Content-Length: + - '63' + Content-Type: + - application/x-www-form-urlencoded + Cookie: + - AUTH_SESSION_ID_LEGACY=cd960bc6-074c-45cf-8ceb-6416b368d6d2; KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlNzE1ZTA1MS02Y2RiLTQ4Y2MtYjRmNC1mMDcyMmM4MWY5ZDMifQ.eyJjaWQiOiJ0ZXN0aWQiLCJwdHkiOiJvcGVuaWQtY29ubmVjdCIsInJ1cmkiOiJodHRwOi8vdGVzdHNlcnZlci9laGVya2VubmluZy1vaWRjL2NhbGxiYWNrLyIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIGt2ayIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9yZWFsbXMvdGVzdCIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwicmVkaXJlY3RfdXJpIjoiaHR0cDovL3Rlc3RzZXJ2ZXIvZWhlcmtlbm5pbmctb2lkYy9jYWxsYmFjay8iLCJzdGF0ZSI6Im5vdC1hLXJhbmRvbS1zdHJpbmciLCJub25jZSI6Im5vdC1hLXJhbmRvbS1zdHJpbmcifX0.SpI7JvuDjU8Dn4CR3RD56sJAxNizNRciRym82v57Ylo + User-Agent: + - python-requests/2.32.2 + method: POST + uri: http://localhost:8080/realms/test/login-actions/authenticate?session_code=Ja-NxxAIBU_H1osU-xx5fKHuTeeRsdzjj2pI2VnLcp4&execution=670fb55e-641e-4beb-bd17-3c0cb001b805&client_id=testid&tab_id=KfMS61-iKzQ + response: + body: + string: '' + headers: + Cache-Control: + - no-store, must-revalidate, max-age=0 + Content-Security-Policy: + - frame-src 'self'; frame-ancestors 'self'; object-src 'none'; + Location: + - http://testserver/eherkenning-oidc/callback/?state=not-a-random-string&session_state=cd960bc6-074c-45cf-8ceb-6416b368d6d2&iss=http%3A%2F%2Flocalhost%3A8080%2Frealms%2Ftest&code=461bd752-0bee-4887-a08d-9c03c018bbb3.cd960bc6-074c-45cf-8ceb-6416b368d6d2.adf4ad83-4550-4619-9231-73bd8d700f45 + Referrer-Policy: + - no-referrer + Set-Cookie: + - KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 + 00:00:10 GMT; Max-Age=0; Path=/realms/test/; HttpOnly + - KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; + Path=/realms/test/; HttpOnly + - KC_AUTH_STATE=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; + Path=/realms/test/ + - KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlNzE1ZTA1MS02Y2RiLTQ4Y2MtYjRmNC1mMDcyMmM4MWY5ZDMifQ.eyJleHAiOjE3MjU1ODU3OTAsImlhdCI6MTcyNTU0OTc5MCwianRpIjoiNzg4NDdjMWQtMWMxNy00MDNkLTk2NGMtZWJmYjFlZjYwNzliIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy90ZXN0Iiwic3ViIjoiYWExMGNmYzctMmM0ZC00MWY2LThmYWMtN2JmNDA1YzU3MmM0IiwidHlwIjoiU2VyaWFsaXplZC1JRCIsInNlc3Npb25fc3RhdGUiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJzaWQiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJzdGF0ZV9jaGVja2VyIjoicXRHdjZ3NnowNHZkWm0ybUsyWmNaU1c0TzN1bHhrYUQycmdjLUpOOHVCTSJ9.uu_nhT-RZN9vNlNEwsNo4zmFTMxTCPPzXE9HoGjiITg; + Version=1; Path=/realms/test/; SameSite=None; Secure; HttpOnly + - KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlNzE1ZTA1MS02Y2RiLTQ4Y2MtYjRmNC1mMDcyMmM4MWY5ZDMifQ.eyJleHAiOjE3MjU1ODU3OTAsImlhdCI6MTcyNTU0OTc5MCwianRpIjoiNzg4NDdjMWQtMWMxNy00MDNkLTk2NGMtZWJmYjFlZjYwNzliIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy90ZXN0Iiwic3ViIjoiYWExMGNmYzctMmM0ZC00MWY2LThmYWMtN2JmNDA1YzU3MmM0IiwidHlwIjoiU2VyaWFsaXplZC1JRCIsInNlc3Npb25fc3RhdGUiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJzaWQiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJzdGF0ZV9jaGVja2VyIjoicXRHdjZ3NnowNHZkWm0ybUsyWmNaU1c0TzN1bHhrYUQycmdjLUpOOHVCTSJ9.uu_nhT-RZN9vNlNEwsNo4zmFTMxTCPPzXE9HoGjiITg; + Version=1; Path=/realms/test/; HttpOnly + - KEYCLOAK_SESSION=test/aa10cfc7-2c4d-41f6-8fac-7bf405c572c4/cd960bc6-074c-45cf-8ceb-6416b368d6d2; + Version=1; Expires=Fri, 06-Sep-2024 01:23:10 GMT; Max-Age=36000; Path=/realms/test/; + SameSite=None; Secure + - KEYCLOAK_SESSION_LEGACY=test/aa10cfc7-2c4d-41f6-8fac-7bf405c572c4/cd960bc6-074c-45cf-8ceb-6416b368d6d2; + Version=1; Expires=Fri, 06-Sep-2024 01:23:10 GMT; Max-Age=36000; Path=/realms/test/ + - KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 + 00:00:10 GMT; Max-Age=0; Path=/realms/test/; HttpOnly + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-Frame-Options: + - SAMEORIGIN + X-Robots-Tag: + - none + X-XSS-Protection: + - 1; mode=block + content-length: + - '0' + status: + code: 302 + message: Found +- request: + body: client_id=testid&client_secret=7DB3KUAAizYCcmZufpHRVOcD0TOkNO3I&grant_type=authorization_code&code=461bd752-0bee-4887-a08d-9c03c018bbb3.cd960bc6-074c-45cf-8ceb-6416b368d6d2.adf4ad83-4550-4619-9231-73bd8d700f45&redirect_uri=http%3A%2F%2Ftestserver%2Feherkenning-oidc%2Fcallback%2F + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Connection: + - keep-alive + Content-Length: + - '279' + Content-Type: + - application/x-www-form-urlencoded + User-Agent: + - python-requests/2.32.2 + method: POST + uri: http://localhost:8080/realms/test/protocol/openid-connect/token + response: + body: + string: '{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0VU5RQWN2VWN2LURGVU94XzRPMWd0MTNPZEpTb3RxRUtQWnVyczJ2UVc4In0.eyJleHAiOjE3MjU1NTAwOTAsImlhdCI6MTcyNTU0OTc5MCwiYXV0aF90aW1lIjoxNzI1NTQ5NzkwLCJqdGkiOiJjODU5YWQ5Yi1lOTdhLTQ3YzAtYTdlMi1lZDZiODg3MzIxYjAiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1zL3Rlc3QiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiYWExMGNmYzctMmM0ZC00MWY2LThmYWMtN2JmNDA1YzU3MmM0IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoidGVzdGlkIiwibm9uY2UiOiJub3QtYS1yYW5kb20tc3RyaW5nIiwic2Vzc2lvbl9zdGF0ZSI6ImNkOTYwYmM2LTA3NGMtNDVjZi04Y2ViLTY0MTZiMzY4ZDZkMiIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovLzEyNy4wLjAuMTo4MDAwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJkZWZhdWx0LXJvbGVzLXRlc3QiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSBrdmsgZ3JvdXBzIGJzbiIsInNpZCI6ImNkOTYwYmM2LTA3NGMtNDVjZi04Y2ViLTY0MTZiMzY4ZDZkMiIsImt2ayI6IjAxMjM0NTY3OCIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwibGVnYWxTdWJqZWN0SUQiOiIxMjM0NTY3OCIsImFjdGluZ1N1YmplY3RJRCI6IjRCNzVBMEVBMTA3QjNEMzYiLCJuYW1lX3F1YWxpZmllciI6InVybjpldG9lZ2FuZzoxLjk6RW50aXR5Q29uY2VybmVkSUQ6S3ZLbnIiLCJncm91cHMiOlsiZGVmYXVsdC1yb2xlcy10ZXN0Iiwib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0dXNlciIsImJzbiI6IjAwMDAwMDAwMCJ9.MSjeT4SB-mdilk6WOfvmvcoqKJam4WNR6vD30ORdGIy8q9hZh3fIkrbcPGEVK-Y7PyUlvV8DWaYWmT5Xka33lENDNyOWiQixz0BVDSb-W32CKxM9o72xXHAdmtU_9XBbhxcQz1h10Cu41mDgfXyjSm4ZLa_0wDK1QNgIqhy0FW40vzseZE6js9UrwPCdsXUdW_q1etgw0Z0jraiAe5sUxA_t8urk8REoaGgACYWtJkAWGUHV5oHvRKPmKxcmtAwjCiPhq6ipA_d6NtlEu77CxjF3CVc_7KdPlMw3xZz-1ynJ8YSglkMa4Ol73prTtED-deno3bFruEA0B5nrGV8-Bg","expires_in":300,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJlNzE1ZTA1MS02Y2RiLTQ4Y2MtYjRmNC1mMDcyMmM4MWY5ZDMifQ.eyJleHAiOjE3MjU1NTE1OTAsImlhdCI6MTcyNTU0OTc5MCwianRpIjoiOGFlNjYxYzUtZWMwMi00NzIyLWIwMWEtYzA5YWU1ZGVmODc4IiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy90ZXN0IiwiYXVkIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy90ZXN0Iiwic3ViIjoiYWExMGNmYzctMmM0ZC00MWY2LThmYWMtN2JmNDA1YzU3MmM0IiwidHlwIjoiUmVmcmVzaCIsImF6cCI6InRlc3RpZCIsIm5vbmNlIjoibm90LWEtcmFuZG9tLXN0cmluZyIsInNlc3Npb25fc3RhdGUiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIGt2ayBncm91cHMgYnNuIiwic2lkIjoiY2Q5NjBiYzYtMDc0Yy00NWNmLThjZWItNjQxNmIzNjhkNmQyIn0.rcxxvH2y1Nhc1WkivVfxor2V0MYrpo7mmLQBNJj8r3M","token_type":"Bearer","id_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0VU5RQWN2VWN2LURGVU94XzRPMWd0MTNPZEpTb3RxRUtQWnVyczJ2UVc4In0.eyJleHAiOjE3MjU1NTAwOTAsImlhdCI6MTcyNTU0OTc5MCwiYXV0aF90aW1lIjoxNzI1NTQ5NzkwLCJqdGkiOiI4ZGQxYzc2NS00MTc5LTRkZTctYWYyNy1kOGNlNjZhYTZiNjciLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1zL3Rlc3QiLCJhdWQiOiJ0ZXN0aWQiLCJzdWIiOiJhYTEwY2ZjNy0yYzRkLTQxZjYtOGZhYy03YmY0MDVjNTcyYzQiLCJ0eXAiOiJJRCIsImF6cCI6InRlc3RpZCIsIm5vbmNlIjoibm90LWEtcmFuZG9tLXN0cmluZyIsInNlc3Npb25fc3RhdGUiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJhdF9oYXNoIjoicm5VWkJUXzloRzFLbnVvRjBBTXlVZyIsImFjciI6IjEiLCJzaWQiOiJjZDk2MGJjNi0wNzRjLTQ1Y2YtOGNlYi02NDE2YjM2OGQ2ZDIiLCJrdmsiOiIwMTIzNDU2NzgiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImxlZ2FsU3ViamVjdElEIjoiMTIzNDU2NzgiLCJhY3RpbmdTdWJqZWN0SUQiOiI0Qjc1QTBFQTEwN0IzRDM2IiwibmFtZV9xdWFsaWZpZXIiOiJ1cm46ZXRvZWdhbmc6MS45OkVudGl0eUNvbmNlcm5lZElEOkt2S25yIiwiZ3JvdXBzIjpbImRlZmF1bHQtcm9sZXMtdGVzdCIsIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdHVzZXIiLCJic24iOiIwMDAwMDAwMDAifQ.cuunXX4wzYhWJcPnXtdV-jfGpd03ORiudLJrEyaluVmVfe0v3BK52e2sUig1zIqXJpdnxgH_-EutiZvbFGwI09qSNW2mwwRlegGsaDy1gVEsNIWr9598adqhwFLVVzvVGBxIao0YBqTDPH4gZuPVc3ecLtw-xRUEa25v0OXsooJ8bWDtpegJ24SitDorghLG19EnhuOn0tVjaPqrXQ6OKCgn0bExonQoQlpjXHqDo2ob8fjQb8QfTGIoK-NSO6dfNmS-BhaHwa3usaleI6XRrFZrpiuWaJWKsFz4riGB5CUtiom9tiEA8cv_4giZ_jMzP0UkRRtru4xifhiGxudTKg","not-before-policy":0,"session_state":"cd960bc6-074c-45cf-8ceb-6416b368d6d2","scope":"openid + email profile kvk groups bsn"}' + headers: + Cache-Control: + - no-store + Content-Type: + - application/json + Pragma: + - no-cache + Referrer-Policy: + - no-referrer + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-Frame-Options: + - SAMEORIGIN + X-XSS-Protection: + - 1; mode=block + content-length: + - '4018' + status: + code: 200 + message: OK +- request: + body: null + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Connection: + - keep-alive + User-Agent: + - python-requests/2.32.2 + method: GET + uri: http://localhost:8080/realms/test/protocol/openid-connect/certs + response: + body: + string: '{"keys":[{"kid":"4UNQAcvUcv-DFUOx_4O1gt13OdJSotqEKPZurs2vQW8","kty":"RSA","alg":"RS256","use":"sig","n":"2DOZ0qHie73SuFVR7civrl6r82YUiAghfzaMowjCg0o06AF--2lIS7vNV_PbsVVznPAAMqVrNG-8CcevEzvVZMQD9nH4DI7xlOxK0lrYu8rmMeSfOvXVbBVsWBZe0jnGNukZqjwmRE5__ttJdxPfIBT5-2L6mguQbDfhSUEEdIW7y7UfOXvqLqEcBtoIEB-ORKDTUIQwGZM5mSCy-cY3cHvvZfZVgaUUy5NvujPRXTMje4n_hG0KfEV-40G9qC2_Xvx4EooJzBZ6FSThiWhCpwhIvzcQqB6M9lHW7nU6wADhYPNCa2OKWvphwZ_zbrF4B9dmS6Zli5rBvbox9Hh45w","e":"AQAB","x5c":["MIIClzCCAX8CBgGNeYaMLTANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTI0MDIwNTEzNDYxN1oXDTM0MDIwNTEzNDc1N1owDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgzmdKh4nu90rhVUe3Ir65eq/NmFIgIIX82jKMIwoNKNOgBfvtpSEu7zVfz27FVc5zwADKlazRvvAnHrxM71WTEA/Zx+AyO8ZTsStJa2LvK5jHknzr11WwVbFgWXtI5xjbpGao8JkROf/7bSXcT3yAU+fti+poLkGw34UlBBHSFu8u1Hzl76i6hHAbaCBAfjkSg01CEMBmTOZkgsvnGN3B772X2VYGlFMuTb7oz0V0zI3uJ/4RtCnxFfuNBvagtv178eBKKCcwWehUk4YloQqcISL83EKgejPZR1u51OsAA4WDzQmtjilr6YcGf826xeAfXZkumZYuawb26MfR4eOcCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAsnQG/Yi2g1XTCJn74hWv9MjxVAaZb4gBAc2AWm5VgAjhFEM9h6x6m1mQkq7JM4rIdAj8jw55Ok9CBVBIqq4G4cME3eUvVytkj2lC9zcRoAivjjZF2HPg7zNPa2TTR50asmHPRokppV6gewO/C+o5as+4P2zqDXBh61aRd/9kdQfkg14LBbH5/dYccAuvUqlTYC4IEPCvVmBNC1xsMjf0vohvoSjm9vL2bfqG/RJH0ScdCjOd5d2zju4/e2oVdluWm+vzKBQplc7tVMuKpn6LcLmVHiGNAl+EBIZH+WVLlTx0D1+kbHZsfLYG53lQg2LsvurRbWyF/a5fVM/oLTn5ag=="],"x5t":"H5xfs1pRtvX0HyVTskx7eTXx88U","x5t#S256":"XurVtKAIEyc4w9HCGOhnjoRHnYu4d9HCn_5YHmkScJg"},{"kid":"TV3Tl5jIY1nrJLSb53UKEubLR5gYiq9slq1SsDDg1HU","kty":"RSA","alg":"RSA-OAEP","use":"enc","n":"pNvU3ecpVHbJT4bCOEpw6cnV1yi65tB3I0bRF2ilLVOY944QRAGnjBBECPIzNbgqavghYp1j75F2nq6_ny1CYfoaxTV2iDpRUw8_f7sliYbl8FrLLat0S25ItlZrg5TEJHObvOqlG2_nXoeH36MRWwNhms2uCqfhn5VgtenIzpQIBolnM7zzGp21NvdJ1C_ZAUzkXC-l3oQ-BXTtpEVM4h2KpYh4gfZJWCbYij5d1e1YApKD6V61_Cs3Oa2OY7CAUyq5kgAWJZFDB6CpzIr226u3bV7F9RbrQu3Ybc_Lv33EwykscLznKWZY2Mbs3Iz_rFNv3sVX_vHpH4DHWlKu7Q","e":"AQAB","x5c":["MIIClzCCAX8CBgGNeYaMlzANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTI0MDIwNTEzNDYxN1oXDTM0MDIwNTEzNDc1N1owDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKTb1N3nKVR2yU+GwjhKcOnJ1dcouubQdyNG0RdopS1TmPeOEEQBp4wQRAjyMzW4Kmr4IWKdY++Rdp6uv58tQmH6GsU1dog6UVMPP3+7JYmG5fBayy2rdEtuSLZWa4OUxCRzm7zqpRtv516Hh9+jEVsDYZrNrgqn4Z+VYLXpyM6UCAaJZzO88xqdtTb3SdQv2QFM5Fwvpd6EPgV07aRFTOIdiqWIeIH2SVgm2Io+XdXtWAKSg+letfwrNzmtjmOwgFMquZIAFiWRQwegqcyK9turt21exfUW60Lt2G3Py799xMMpLHC85ylmWNjG7NyM/6xTb97FV/7x6R+Ax1pSru0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAQGJHeTYSMvp0yndbIn7DLohO9lom5nRrx/bLyb7TiRfogyJEF6rQZ66CAkQFk5eMF878fsHTuMVjtmXVBnhojhVmK91HwjsNQu/8xR6QMXNKJQMvHR245vwUGxlWRw/36ObM1D7QjCd/q+FonpBEY4m5Y6Uz1U0HR2Cbh0E2afVlPLeV+F0LKrlyVMdIaWBGWftCGIKDAHaG/PD66zbAKtxerv2fBIDq100WHPhd57BZxX+2aGJp1IaRDgkxV0E/CjEy3+Knd8xbAgUSW0Tl6OTC75exIvlbzeluEBe0wlapAb7WvBKYsipSW8G8Ey7tjoolDT4AU82EaKUPstiMnA=="],"x5t":"AlfHDI0FOPQpt3RBAILt0dtW1yw","x5t#S256":"a7bhm8-JsnfY7bL_m8Yl72hgmp5516VZlFcVloKzk08"}]}' + headers: + Cache-Control: + - no-cache + Content-Type: + - application/json;charset=UTF-8 + Referrer-Policy: + - no-referrer + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-Frame-Options: + - SAMEORIGIN + X-XSS-Protection: + - 1; mode=block + content-length: + - '2909' + status: + code: 200 + message: OK +- request: + body: null + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Authorization: + - Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0VU5RQWN2VWN2LURGVU94XzRPMWd0MTNPZEpTb3RxRUtQWnVyczJ2UVc4In0.eyJleHAiOjE3MjU1NTAwOTAsImlhdCI6MTcyNTU0OTc5MCwiYXV0aF90aW1lIjoxNzI1NTQ5NzkwLCJqdGkiOiJjODU5YWQ5Yi1lOTdhLTQ3YzAtYTdlMi1lZDZiODg3MzIxYjAiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjgwODAvcmVhbG1zL3Rlc3QiLCJhdWQiOiJhY2NvdW50Iiwic3ViIjoiYWExMGNmYzctMmM0ZC00MWY2LThmYWMtN2JmNDA1YzU3MmM0IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoidGVzdGlkIiwibm9uY2UiOiJub3QtYS1yYW5kb20tc3RyaW5nIiwic2Vzc2lvbl9zdGF0ZSI6ImNkOTYwYmM2LTA3NGMtNDVjZi04Y2ViLTY0MTZiMzY4ZDZkMiIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovLzEyNy4wLjAuMTo4MDAwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJkZWZhdWx0LXJvbGVzLXRlc3QiLCJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSBrdmsgZ3JvdXBzIGJzbiIsInNpZCI6ImNkOTYwYmM2LTA3NGMtNDVjZi04Y2ViLTY0MTZiMzY4ZDZkMiIsImt2ayI6IjAxMjM0NTY3OCIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwibGVnYWxTdWJqZWN0SUQiOiIxMjM0NTY3OCIsImFjdGluZ1N1YmplY3RJRCI6IjRCNzVBMEVBMTA3QjNEMzYiLCJuYW1lX3F1YWxpZmllciI6InVybjpldG9lZ2FuZzoxLjk6RW50aXR5Q29uY2VybmVkSUQ6S3ZLbnIiLCJncm91cHMiOlsiZGVmYXVsdC1yb2xlcy10ZXN0Iiwib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ0ZXN0dXNlciIsImJzbiI6IjAwMDAwMDAwMCJ9.MSjeT4SB-mdilk6WOfvmvcoqKJam4WNR6vD30ORdGIy8q9hZh3fIkrbcPGEVK-Y7PyUlvV8DWaYWmT5Xka33lENDNyOWiQixz0BVDSb-W32CKxM9o72xXHAdmtU_9XBbhxcQz1h10Cu41mDgfXyjSm4ZLa_0wDK1QNgIqhy0FW40vzseZE6js9UrwPCdsXUdW_q1etgw0Z0jraiAe5sUxA_t8urk8REoaGgACYWtJkAWGUHV5oHvRKPmKxcmtAwjCiPhq6ipA_d6NtlEu77CxjF3CVc_7KdPlMw3xZz-1ynJ8YSglkMa4Ol73prTtED-deno3bFruEA0B5nrGV8-Bg + Connection: + - keep-alive + User-Agent: + - python-requests/2.32.2 + method: GET + uri: http://localhost:8080/realms/test/protocol/openid-connect/userinfo + response: + body: + string: eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICI0VU5RQWN2VWN2LURGVU94XzRPMWd0MTNPZEpTb3RxRUtQWnVyczJ2UVc4In0.eyJzdWIiOiJhYTEwY2ZjNy0yYzRkLTQxZjYtOGZhYy03YmY0MDVjNTcyYzQiLCJrdmsiOiIwMTIzNDU2NzgiLCJhdWQiOiJ0ZXN0aWQiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImxlZ2FsU3ViamVjdElEIjoiMTIzNDU2NzgiLCJhY3RpbmdTdWJqZWN0SUQiOiI0Qjc1QTBFQTEwN0IzRDM2IiwibmFtZV9xdWFsaWZpZXIiOiJ1cm46ZXRvZWdhbmc6MS45OkVudGl0eUNvbmNlcm5lZElEOkt2S25yIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL3JlYWxtcy90ZXN0IiwiZ3JvdXBzIjpbImRlZmF1bHQtcm9sZXMtdGVzdCIsIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXSwicHJlZmVycmVkX3VzZXJuYW1lIjoidGVzdHVzZXIiLCJic24iOiIwMDAwMDAwMDAifQ.J2Bfcd1F9wUCureqh3JXo8oHFr7Aol2gumeh0Lzvwm2Cxc9f-c8ZXChJykDV50mvTs6fz6D8m3S4rHIdz27SMdGSGYLtMfmAdxYnKnY5zUmpmqcRqBELV8-jfEewSNtaBD-nM8TOK-qoDropCwEf0100n_Daf5tk3gYliBia-EZQ_YnC19w_ynLy4F2UvJB0HkZP431BOD6AaUpL--e14orHsAVApoFFwilkMzZv7oG9Qgns0DQPQLZz82DnU33WzzbC3MkGINRCj9-5VcY5HCRTDW_GF4WHUBwpJyMZR1an6-SrbdJ3kjlfSQ-Nqn0ax16Je54-ijafnCECj8wooQ + headers: + Cache-Control: + - no-cache + Content-Type: + - application/jwt + Referrer-Policy: + - no-referrer + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-XSS-Protection: + - 1; mode=block + content-length: + - '973' + status: + code: 200 + message: OK +- request: + body: null + headers: + Accept: + - '*/*' + Accept-Encoding: + - gzip, deflate, br + Connection: + - keep-alive + User-Agent: + - python-requests/2.32.2 + method: GET + uri: http://localhost:8080/realms/test/protocol/openid-connect/certs + response: + body: + string: '{"keys":[{"kid":"4UNQAcvUcv-DFUOx_4O1gt13OdJSotqEKPZurs2vQW8","kty":"RSA","alg":"RS256","use":"sig","n":"2DOZ0qHie73SuFVR7civrl6r82YUiAghfzaMowjCg0o06AF--2lIS7vNV_PbsVVznPAAMqVrNG-8CcevEzvVZMQD9nH4DI7xlOxK0lrYu8rmMeSfOvXVbBVsWBZe0jnGNukZqjwmRE5__ttJdxPfIBT5-2L6mguQbDfhSUEEdIW7y7UfOXvqLqEcBtoIEB-ORKDTUIQwGZM5mSCy-cY3cHvvZfZVgaUUy5NvujPRXTMje4n_hG0KfEV-40G9qC2_Xvx4EooJzBZ6FSThiWhCpwhIvzcQqB6M9lHW7nU6wADhYPNCa2OKWvphwZ_zbrF4B9dmS6Zli5rBvbox9Hh45w","e":"AQAB","x5c":["MIIClzCCAX8CBgGNeYaMLTANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTI0MDIwNTEzNDYxN1oXDTM0MDIwNTEzNDc1N1owDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANgzmdKh4nu90rhVUe3Ir65eq/NmFIgIIX82jKMIwoNKNOgBfvtpSEu7zVfz27FVc5zwADKlazRvvAnHrxM71WTEA/Zx+AyO8ZTsStJa2LvK5jHknzr11WwVbFgWXtI5xjbpGao8JkROf/7bSXcT3yAU+fti+poLkGw34UlBBHSFu8u1Hzl76i6hHAbaCBAfjkSg01CEMBmTOZkgsvnGN3B772X2VYGlFMuTb7oz0V0zI3uJ/4RtCnxFfuNBvagtv178eBKKCcwWehUk4YloQqcISL83EKgejPZR1u51OsAA4WDzQmtjilr6YcGf826xeAfXZkumZYuawb26MfR4eOcCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAsnQG/Yi2g1XTCJn74hWv9MjxVAaZb4gBAc2AWm5VgAjhFEM9h6x6m1mQkq7JM4rIdAj8jw55Ok9CBVBIqq4G4cME3eUvVytkj2lC9zcRoAivjjZF2HPg7zNPa2TTR50asmHPRokppV6gewO/C+o5as+4P2zqDXBh61aRd/9kdQfkg14LBbH5/dYccAuvUqlTYC4IEPCvVmBNC1xsMjf0vohvoSjm9vL2bfqG/RJH0ScdCjOd5d2zju4/e2oVdluWm+vzKBQplc7tVMuKpn6LcLmVHiGNAl+EBIZH+WVLlTx0D1+kbHZsfLYG53lQg2LsvurRbWyF/a5fVM/oLTn5ag=="],"x5t":"H5xfs1pRtvX0HyVTskx7eTXx88U","x5t#S256":"XurVtKAIEyc4w9HCGOhnjoRHnYu4d9HCn_5YHmkScJg"},{"kid":"TV3Tl5jIY1nrJLSb53UKEubLR5gYiq9slq1SsDDg1HU","kty":"RSA","alg":"RSA-OAEP","use":"enc","n":"pNvU3ecpVHbJT4bCOEpw6cnV1yi65tB3I0bRF2ilLVOY944QRAGnjBBECPIzNbgqavghYp1j75F2nq6_ny1CYfoaxTV2iDpRUw8_f7sliYbl8FrLLat0S25ItlZrg5TEJHObvOqlG2_nXoeH36MRWwNhms2uCqfhn5VgtenIzpQIBolnM7zzGp21NvdJ1C_ZAUzkXC-l3oQ-BXTtpEVM4h2KpYh4gfZJWCbYij5d1e1YApKD6V61_Cs3Oa2OY7CAUyq5kgAWJZFDB6CpzIr226u3bV7F9RbrQu3Ybc_Lv33EwykscLznKWZY2Mbs3Iz_rFNv3sVX_vHpH4DHWlKu7Q","e":"AQAB","x5c":["MIIClzCCAX8CBgGNeYaMlzANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTI0MDIwNTEzNDYxN1oXDTM0MDIwNTEzNDc1N1owDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKTb1N3nKVR2yU+GwjhKcOnJ1dcouubQdyNG0RdopS1TmPeOEEQBp4wQRAjyMzW4Kmr4IWKdY++Rdp6uv58tQmH6GsU1dog6UVMPP3+7JYmG5fBayy2rdEtuSLZWa4OUxCRzm7zqpRtv516Hh9+jEVsDYZrNrgqn4Z+VYLXpyM6UCAaJZzO88xqdtTb3SdQv2QFM5Fwvpd6EPgV07aRFTOIdiqWIeIH2SVgm2Io+XdXtWAKSg+letfwrNzmtjmOwgFMquZIAFiWRQwegqcyK9turt21exfUW60Lt2G3Py799xMMpLHC85ylmWNjG7NyM/6xTb97FV/7x6R+Ax1pSru0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAQGJHeTYSMvp0yndbIn7DLohO9lom5nRrx/bLyb7TiRfogyJEF6rQZ66CAkQFk5eMF878fsHTuMVjtmXVBnhojhVmK91HwjsNQu/8xR6QMXNKJQMvHR245vwUGxlWRw/36ObM1D7QjCd/q+FonpBEY4m5Y6Uz1U0HR2Cbh0E2afVlPLeV+F0LKrlyVMdIaWBGWftCGIKDAHaG/PD66zbAKtxerv2fBIDq100WHPhd57BZxX+2aGJp1IaRDgkxV0E/CjEy3+Knd8xbAgUSW0Tl6OTC75exIvlbzeluEBe0wlapAb7WvBKYsipSW8G8Ey7tjoolDT4AU82EaKUPstiMnA=="],"x5t":"AlfHDI0FOPQpt3RBAILt0dtW1yw","x5t#S256":"a7bhm8-JsnfY7bL_m8Yl72hgmp5516VZlFcVloKzk08"}]}' + headers: + Cache-Control: + - no-cache + Content-Type: + - application/json;charset=UTF-8 + Referrer-Policy: + - no-referrer + Strict-Transport-Security: + - max-age=31536000; includeSubDomains + X-Content-Type-Options: + - nosniff + X-Frame-Options: + - SAMEORIGIN + X-XSS-Protection: + - 1; mode=block + content-length: + - '2909' + status: + code: 200 + message: OK +version: 1 diff --git a/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py b/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py index decdd30192..90626b376c 100644 --- a/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py +++ b/src/openforms/authentication/contrib/digid_eherkenning_oidc/tests/test_auth_flow_callbacks.py @@ -202,6 +202,22 @@ def test_failure_with_missing_acting_subject_claim(self): submission = Submission.objects.get() self.assertTrue(submission.is_authenticated) + @tag("gh-4627") + @enable_feature_flag("DIGID_EHERKENNING_OIDC_STRICT") + @mock_eherkenning_config(acting_subject_claim=["does not exist"]) + def test_failure_with_missing_acting_subject_claim_strict_mode(self): + form = FormFactory.create(authentication_backends=["eherkenning_oidc"]) + url_helper = URLsHelper(form=form) + start_url = url_helper.get_auth_start(plugin_id="eherkenning_oidc") + start_response = self.app.get(start_url) + # simulate login to Keycloak + redirect_uri = keycloak_login(start_response["Location"]) + + # complete the login flow on our end + response = self.app.get(redirect_uri, auto_follow=True) + + self.assertIn("of-auth-problem", response.request.GET) + @mock_eherkenning_config(legal_subject_claim=["absent-claim"]) def test_failing_claim_verification(self): form = FormFactory.create(authentication_backends=["eherkenning_oidc"])