From 08e41381a527721da292e42fac8179c0b00d0469 Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Mon, 6 Jul 2026 15:46:20 +0200 Subject: [PATCH 1/2] REF-16: Force OCSP requests to POST in tests so CRLCheckerTest can reach the responder The JDK OCSP client uses the RFC 5019 GET form (request base64-encoded in the URL path) for small requests. The NemLog-in test OCSP responder at ca1.cti-gov.dk returns HTTP 404 for that GET form (it only serves POST), so CRLCheckerTest's OCSP validation failed with UNDETERMINED_REVOCATION_STATUS and dropped the otherwise-valid certificate. Set com.sun.security.ocsp.useget=false in BaseServiceTest.beforeAll so the JDK POSTs the OCSP request (request in the body) instead. Verified end-to-end that this makes the responder return "good" and the certificate validate. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../test/java/dk/gov/oio/saml/service/BaseServiceTest.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/service/BaseServiceTest.java b/oiosaml/src/test/java/dk/gov/oio/saml/service/BaseServiceTest.java index b9d5132..cb87943 100644 --- a/oiosaml/src/test/java/dk/gov/oio/saml/service/BaseServiceTest.java +++ b/oiosaml/src/test/java/dk/gov/oio/saml/service/BaseServiceTest.java @@ -16,6 +16,12 @@ public class BaseServiceTest { @BeforeAll public static void beforeAll(MockServerClient idp) throws Exception { + // Force the JDK OCSP client to POST the request instead of using the RFC 5019 GET form + // (request base64-encoded in the URL path). The NemLog-in test OCSP responder returns + // HTTP 404 for the GET form, which otherwise makes CRLCheckerTest's OCSP checks fail with + // UNDETERMINED_REVOCATION_STATUS. Must be set before the first OCSP check. + System.setProperty("com.sun.security.ocsp.useget", "false"); + ClassLoader classLoader = AssertionServiceTest.class.getClassLoader(); String keystoreLocation = classLoader.getResource(TestConstants.SP_KEYSTORE_LOCATION).getFile(); From 5ecd6931776ff27b85c66779945e966edeeab75f Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Mon, 6 Jul 2026 15:52:26 +0200 Subject: [PATCH 2/2] REF-16: Use a genuinely revoked certificate for the revoked revocation tests Replace TestConstants.REVOKED_CERTIFICATE with a certificate that is actually revoked at the NemLog-in test CA (verified: OCSP reports "revoked" and the serial is present in the issuing CRL; valid 2026-07-06 .. 2029-07-05). The revoked OCSP/CRL tests now pass because the certificate is genuinely revoked, rather than incidentally due to an unreachable responder. Tag both testOcspCheckOnRevokedCertificate and testCrlCheckOnRevokedCertificate with @Tag("integration") since they depend on the live test CA revocation infrastructure. No group filtering is configured, so they still run by default; the tag allows excluding them from offline runs via -DexcludedGroups=integration. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../java/dk/gov/oio/saml/service/CRLCheckerTest.java | 9 +++++++++ .../test/java/dk/gov/oio/saml/util/TestConstants.java | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java b/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java index d3ca909..ab3848c 100644 --- a/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java +++ b/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java @@ -11,6 +11,7 @@ import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.DisplayName; +import org.junit.jupiter.api.Tag; import org.junit.jupiter.api.Test; import dk.gov.oio.saml.util.TestConstants; @@ -51,6 +52,10 @@ public class CRLCheckerTest extends BaseServiceTest { Assertions.assertEquals(1, validCertificates.size()); } + // Integration test: depends on the live NemLog-in test CA revocation infrastructure + // (the revoked certificate's real OCSP/CRL status). Tagged so it can be excluded from + // offline runs if needed, but it runs by default. + @Tag("integration") @DisplayName("Test revocation check on revoked certificate using OCSP") @Test public void testOcspCheckOnRevokedCertificate() throws Exception { OIOSAML3Service.getConfig().setCRLCheckEnabled(false); @@ -69,6 +74,10 @@ public class CRLCheckerTest extends BaseServiceTest { Assertions.assertEquals(0, validCertificates.size()); } + // Integration test: depends on the live NemLog-in test CA revocation infrastructure + // (the revoked certificate's real OCSP/CRL status). Tagged so it can be excluded from + // offline runs if needed, but it runs by default. + @Tag("integration") @DisplayName("Test revocation check on revoked certificate using CRL") @Test public void testCrlCheckOnRevokedCertificate() throws Exception { OIOSAML3Service.getConfig().setCRLCheckEnabled(true); diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java b/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java index 87c2226..5424a13 100644 --- a/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java +++ b/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java @@ -150,5 +150,5 @@ public class TestConstants { public static final String VALID_CERTIFICATE = "MIIGkzCCBMegAwIBAgIUdxCsIBOOtB5tqNtriG1TMHD9dqYwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yMzA4MTgxMDI2NThaFw0yNjA4MTcxMDI2NTdaMIGpMSUwIwYDVQQDDBxqYXZhLnJlZmVyZW5jZWltcGxlbWVudGVyaW5nMTcwNQYDVQQFEy5VSTpESy1POkc6MmRjZjc5MTktYjI4Mi00NGQxLWI5ODAtM2I3MzcwMGE3ZGQ0MSEwHwYDVQQKDBhEaWdpdGFsaXNlcmluZ3NzdHlyZWxzZW4xFzAVBgNVBGEMDk5UUkRLLTM0MDUxMTc4MQswCQYDVQQGEwJESzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKNAf9uAhuz3bEjPPFrBa39HCF6S64pSzGRr5yYm3lCBElYJvHzDr9lMKgbv8rKglIVgjWh+PzUjiwIlGjrqAbYa2Hg08Vw2H60GQSFP8rGsshgR+E5Ca2nb9kUcQXAQJl9ScG9squCPRNkdp8vSblRwv/3N0ksjxdZk1wdZ86bOqTsFEjpzhFdBXXSMl4tbhE7WOruKc0QqjUkzXJyp4qwyB2XA75+jsvtRHN/luOzCkUxLhEkFrbg+B6IWqjUuO132xC8d5+T8Y39K6rs4BYOIgQRJOg0OlA5844CC/WBLtAYgMiu1ucZ4mbVWOmm2F86WVRBdmwlN0CFORXihHiYNZfHpA0rPOSncDDMrrGZ7vuvvXxMfIiHlAniSw4eHaEqtaXqwDyNZbfcXgYkszQd7ZV7YMfAjkDo82Qn+Qz+Oc9qq0Syhd9pdUJ/Q26CjFDiaNSg+hDUUJTxowQAktX3AuwBcDeuMoc2yOGmg2xOf/3bIwJSNm8/b+y0wKfY2FwIDAQABo4IBhjCCAYIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBR/KJ/ZcZlC4nXn1zV2Lk0IJW12XjB7BggrBgEFBQcBAQRvMG0wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY2VzL2lzc3VpbmcvMS9jYWNlcnQvaXNzdWluZy5jZXIwJgYIKwYBBQUHMAGGGmh0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY3NwMCEGA1UdIAQaMBgwCAYGBACPegEBMAwGCiqBUIEpAQEBAwcwOwYIKwYBBQUHAQMELzAtMCsGCCsGAQUFBwsCMB8GBwQAi+xJAQIwFIYSaHR0cHM6Ly91aWQuZ292LmRrMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY2VzL2lzc3VpbmcvMS9jcmwvaXNzdWluZy5jcmwwHQYDVR0OBBYEFNKFKxc70Coluez0ieqiVuK+a01oMA4GA1UdDwEB/wQEAwIFoDBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASADggGBAIkUbY8meqO9xQQ2gyMS4rfmqW3bV52YGs07DqG0zuVew7W7RMAJWqDLUj5ltMWK7wULcCBS1tjtxOrvMBCoAE42oQfF/EzLRYKr7VgsMyOgUiTk2t6LvyF5A1OGHOUP3lxQKX3viDURXUeoI4QZ3mxbHUg4sQXdXg2hOEhQOarOhWLdV3MzUkA9ZkwjmycXkbLBVdTbr/fODUU0jeDDlaixKXsGI66qg8Ou86nDkyW7wCxQ9QVwJ5YGogy9ZSc6sLt8XSv3+wFlXD/81EzWfqe5BdWX8cukLtSzdzg3SzJifB4IJ6GIQ58+NVLPEMezwZCLODzVkvdJfyWRxJrDijSVCza515qNW52yfYPYkTb+vdvKcFmwO1gCeK0vT21udVkp1grhNzwb8Cj/tq3OZ+IamZXkjL1go9GzSQQ31IbXHEI/oaPLEeX6j9E8X69wVtSti8SWPw0WgoeOglJM5A6fmlJIGhCBPk2klhH3IIU3+tjuz7iyFHZg7gbPhNHdow=="; - public static final String REVOKED_CERTIFICATE = "MIIGizCCBL+gAwIBAgIUNtX5gOHMima7NNCirR0xYtZD5dQwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yMzA3MDQwODQyMjZaFw0yNjA3MDMwODQyMjVaMIGDMRAwDgYDVQQDDAdSZXZva2VkMTcwNQYDVQQFEy5VSTpESy1POkc6Mjc1ODFhMzktYjYxNC00YzYxLWJlY2UtOWIyYjA5Zjg1NzJhMRAwDgYDVQQKDAdpZDIgQS9TMRcwFQYDVQRhDA5OVFJESy00NDE2MDMxNTELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDGFxjnzy3gKPLBt2Lj4ALK2uHAMFB8CZc4DaJDdn6YWNOdL4bvi2Ip0Nf87A9IZT3KzLsyju5pqQOaJ1MlwTB11Hlwne4DHUOo8EZhMAS2/oWtTf+scmbDXR0Edv05ecteReabO7tRyQcbxacirX20rT8jTVLtvWfzCHobvbCK9wWTXiaYYZXZykrHbCrRikuHz7DtyefznKRC36wC3sBzptA4ncdDnhiwOoDizZ46toMYahDLj2P1VDIh+2XyWKPV5rxTlZkY3b+H235tdRtjkX+kTfUDFBVt8PrU7/Pq1D1NHIQsvoHmSsUHwK0QqDGeCbj6qQMs5p5PhBksKdh7Xkfsoh6oTwvXRdbLmjcuc7rIoUB2QidfgltZ2bqSpGX+xvg4uQCKCgqn6TlXUCpDrLKKplE0MnYIyNuWrS/Grj11GJnmfTAsAVkXgM8dSXsBhf0JmMBMXLRTUuz1axxeNy3e29fXDEuoXPoTZ8a9EFTzgA/1l9n67qolWlZV5C8CAwEAAaOCAaQwggGgMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUfyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAChjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lzc3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2NzcDAcBgNVHREEFTATgRF0aG9tYXNAbnltYW5kLm5ldDAhBgNVHSAEGjAYMAgGBgQAj3oBATAMBgoqgVCBKQEBAQMHMDsGCCsGAQUFBwEDBC8wLTArBggrBgEFBQcLAjAfBgcEAIvsSQECMBSGEmh0dHBzOi8vdWlkLmdvdi5kazBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY3JsL2lzc3VpbmcuY3JsMB0GA1UdDgQWBBS6ZyVKq8su7B6OPmH0lkvc6nYpqzAOBgNVHQ8BAf8EBAMCBeAwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgA4IBgQCNt3wTWs0HKYutrfPxw06SmQdeS/bZDBtiallEYaE9HclkWPFIGii8V0gHYyvV6i90f+Sz9FWjAohhQCaMWVkImKG+8EU4mgAjkSRJa4/GpsB9KKQZs26dNayKTdbL/x9MajgaPBPp+kYuVPOjX6oXgLG8huaJ8GqsjQocGd9JPX4k/ir6S+E4Q4Q3PG89HCX9R+28XjT4R/SUwxIvjnf0eKapS/LZdOgk/e5pxTUDWOZhlmJLlXsDAcwXlQ+0vhX4Euk08RKqAi+jK2n2qKIiAg2UFfgdtg7Fu4hWkbLMH/KFf2U21vdmVZAgiOAPmipkuFOwiJV8Q6k5kIVf+OoxBlkUCK6Z9j3Cxuaa1bOif13Iyv003Gns2GCAULA4i+yloYkWHE1jPi1KaLhpcMbf7eRE9MEmS/JVBNVXpDi1M3Y6s6gltO4xbctJPPpnvopyHEhRQx0zQTxk7FcY5izmI+ld62eCLKtPEvV0oVGXVoUGkUqnz5IZmXpBTXVt+YA="; + public static final String REVOKED_CERTIFICATE = "MIIGbjCCBKKgAwIBAgIUSC6sLWUUKtMVPVEu8snwA47QlqgwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yNjA3MDYxMzMyMzZaFw0yOTA3MDUxMzMyMzVaMIGDMRAwDgYDVQQDDAdSZXZva2VkMTcwNQYDVQQFEy5VSTpESy1POkc6Mjc1ODFhMzktYjYxNC00YzYxLWJlY2UtOWIyYjA5Zjg1NzJhMRAwDgYDVQQKDAdpZDIgQS9TMRcwFQYDVQRhDA5OVFJESy00NDE2MDMxNTELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDWBfNLzMmPCnFq9kRVStjsaGyiN6jO2vNRS/w1VTHW1UWPpdZZ07CsEOKFDgOy6Nd+Ra4wN/cnkE49+Bf/QDJQjZE2gtho+ajELFmrgrtPjscn4Htp+q9rd4X698LmFwc9J00bQMBgZ0Zr2KdWsfp5tYa5JP/Ro3w81FZx/xB7zOm/U1rw7be9gN9TvgWVZHK7z529lAnhVW5KSsJdrckeJvZtxX9EoGeWmeVY3OJM/QjJbXAUkouaizTt54Gfc0mpPXGv+MBK+ufGlQtJJZkdbjifS5HY7EgYD/+WM6SFNzRYeM5TU7+QMBZSlcaSoCCOLKN5/fjlXbkPRsUSx4coj37/LFmAhszkAV8CCotXe/Q6DlNtxWAAEnxmCSrKhMHCdRnEZaSDf4o7zBWl4tKpLbS/fqWC2+gV1euH4pV858uJKsoRmM1eSw5DU0NSnMenreZo0Q8VL9wz1AGnoCycqST5s+deRIJJgtB18NMlGv3LBsIuiEDB35zK8CnyOVUCAwEAAaOCAYcwggGDMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUfyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAChjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lzc3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2NzcDAiBgNVHSAEGzAZMAgGBgQAj3oBATANBgsqgVCBKQEBAQMHATA7BggrBgEFBQcBAwQvMC0wKwYIKwYBBQUHCwIwHwYHBACL7EkBAjAUhhJodHRwczovL3VpZC5nb3YuZGswRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NhMS5jdGktZ292LmRrL29jZXMvaXNzdWluZy8xL2NybC9pc3N1aW5nLmNybDAdBgNVHQ4EFgQU3TbRHMKCpscjpajDI1TJoOzaPhIwDgYDVR0PAQH/BAQDAgWgMEEGCSqGSIb3DQEBCjA0oA8wDQYJYIZIAWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQCiAwIBIAOCAYEAK8HpHPPvXC1IPUVCIfkO0VwnvCBOLrCsr01pziBPg8AV0aVw2gEpyNi0xuIEqS3ipzObHwJu8s99e+rsrFjxCPPAG+Dq8tI1Hl85roZ5sanmLQMZLJMfQzKctImGT/3Q3WSxGGWkLkGObTPZcejLLKNjAfHd5Ufqx7q4wkU7UG/+OpJl8uS3AN2zZMi/39Lgnqraor0AgAmxA5DSv7h06YglgkVrLT4gzd/upTrODaYGia9l8UPGaP+tD0Jc/RRWe59vfGIz36QSu5ceIrgv/t1LQ2H0gl6pzruQ1aZDMYh4pygZbXROGv3UVURNyuftMFWwGE6snJquvlP8mPj9/HW75WD8kl2ART8YT41/BkOFbE6aC+Qgkl46Bx1WpktGElM6NGb4UlBDAwGp2Xin2tVITOuRBPKoAv3I2Fxkh7EBiMmWLZ58l8gCpW2/qOXZAdlnLiDkzc+qvXprYm81T2+Y3eA0LSOpNWOLPe77sjEj0/f92aZSb6+pviML7sDb"; }