add shibboleth collection

2026-08-19 12:11:53 +02:00
parent 80b134e32a
commit a533f1a66b
8 changed files with 501 additions and 0 deletions
@@ -0,0 +1,9 @@
+# Secrets
+.env*
+
+# Dependencies
+node_modules
+
+# OS files
+.DS_Store
+Thumbs.db
@@ -0,0 +1,28 @@
+info:
+  name: Authorize (manual flow in browser)
+  type: http
+  seq: 2
+
+http:
+  method: GET
+  url: "{{serverUri}}/idp/profile/oidc/authorize?client_id={{clientId}}&redirect_uri={{redirectUri}}&response_type=code&scope=openid profile email"
+  params:
+    - name: client_id
+      value: "{{clientId}}"
+      type: query
+    - name: redirect_uri
+      value: "{{redirectUri}}"
+      type: query
+    - name: response_type
+      value: code
+      type: query
+    - name: scope
+      value: openid profile email
+      type: query
+  auth: inherit
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
@@ -0,0 +1,124 @@
+info:
+  name: Generate Access Token
+  type: http
+  seq: 3
+
+http:
+  method: POST
+  url: "{{serverUri}}/idp/profile/oidc/token"
+  headers:
+    - name: Content-Type
+      value: application/x-www-form-urlencoded
+  body:
+    type: form-urlencoded
+    data:
+      - name: grant_type
+        value: authorization_code
+      - name: redirect_uri
+        value: "{{redirectUri}}"
+      - name: scope
+        value: openid profile email
+      - name: code
+        value: ""
+        description: Paste code obtained by manual flow in browser
+  auth:
+    type: basic
+    username: "{{clientId}}"
+    password: "{{clientSecret}}"
+
+runtime:
+  scripts:
+    - type: after-response
+      code: |-
+        var jsonData = res.getBody();
+        bru.setEnvVar("accessToken", jsonData.access_token);
+    - type: tests
+      code: |-
+        test("Status code is 200", function () {
+            expect(res.getStatus()).to.equal(200);
+        });
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+examples:
+  - name: Token data
+    request:
+      url: https://shibidp.unipr.it/idp/profile/oidc/token
+      method: POST
+      headers:
+        - name: Content-Type
+          value: application/x-www-form-urlencoded
+      params:
+        - name: client_id
+          value: "{{shibbolethClientId}}"
+          type: query
+          disabled: true
+        - name: client_secret
+          value: "{{shibbolethClientSecret}}"
+          type: query
+          disabled: true
+        - name: grant_type
+          value: code
+          type: query
+          disabled: true
+        - name: scope
+          value: openid
+          type: query
+          disabled: true
+        - name: code
+          value: AAdzZWNyZXQxkZu_xOleOZj6LkAn2Il3wl2T_AnIqKZ2rujs1eC6vS3QEi_Xk5cgedRG5tD9UYDN7YDBWfudDOW_mgkCjtXk4V8dCDJAU0G3mAThwV3yUhBsv1ljnZ
+          type: query
+          disabled: true
+      body:
+        type: form-urlencoded
+        data:
+          - name: grant_type
+            value: authorization_code
+          - name: redirect_uri
+            value: https://gitea.unipr.it/user/oauth2/Shibboleth/callback
+          - name: scope
+            value: openid profile email
+          - name: code
+            value: AAdzZWNyZXQx1CToBgEqA8mxMWGsLKf0V86PS2Oz-3bI5BlRuiitj3iXP_qfSJgNzYsMdsIQ9QRmoIOS6ISVvFSyJ5XeHYE_msw6VJELg9S6qsO4mrBBwCaUM9p3zMPwNBwZJVn6vqgGghpMS_xeW2EGthh9W0HBsh7WuPYK4HJVpTYIxgYR782xET0ZU3XxLBknOeMoye2IrH3sYpeCRQCmd1GUyTl1Ra4sGdqYcw3iiISA_FbPMXOLFQN8GcFtEcPxzc9CtH4PHKDYIj_QQx0IUgEH814pyC-Oc5-19Gfg4Ulps9ZHF9rb4csbi9mvWAuJESHcSp5NSAK9tEMFvBUCe_2nr7WyzaGTI1D6Nr1PenxbWIRAmXGF5LtzSrv-8_k8XSdufefACBVbZH6EQWm4smrqSlMab71F5s9wB3rFEK5IuANQblFljG_vfoCATpmk0MCYo47SApSrorMYN5K6yWf4P3PuyQrIdrw0PsRzBWoY8XpzQTGYN1I
+    response:
+      status: 200
+      statusText: OK
+      headers:
+        - name: date
+          value: Wed, 19 Aug 2026 08:57:29 GMT
+        - name: server
+          value: Jetty(11.0.19)
+        - name: strict-transport-security
+          value: max-age=63072000; includeSubDomains, max-age=63072000 ; includeSubDomains ; preload
+        - name: x-content-type-options
+          value: nosniff
+        - name: x-frame-options
+          value: SAMEORIGIN, DENY
+        - name: cache-control
+          value: no-store, no-store
+        - name: content-type
+          value: application/json;charset=utf-8
+        - name: pragma
+          value: no-cache
+        - name: content-security-policy
+          value: frame-ancestors 'none'; base-uri 'none'; script-src 'self' https://shibidp.unipr.it 'unsafe-inline';
+        - name: keep-alive
+          value: timeout=2, max=100
+        - name: connection
+          value: Keep-Alive
+        - name: transfer-encoding
+          value: chunked
+      body:
+        type: json
+        data: |-
+          {
+            "access_token": "AAdzZWNyZXQxO7PLpDizfp4m1e9ERj9_wLc2HaUQ-TtcgcG-CMvVU7D2BbfPpk1uosrMzlMXEy7SCfcrMKExh-w7xc6u4dL4M8Zz0eoZTZmPB59RhV456tGlYIV3fsxShWJzgdr2QvUdap-GVB5cWzPPaXKdBlzn_5lJfeCcoZwTdIEr6ndwNF7iuDyQ4YNbechW31Y9pD8xZYmlrtNqCfQIVkziG136n6UyMurzw1V6s3zuGQ0YXTL7E4hpjk66J7gU3hlkIM9InH9riWRgADUHvaTBdjQcq9TWWuf7-ckcy-MbHJH0_ZuAkYoKTGuXEWhchCdyJeDCZuKDiazko3C9RYQOWQqaFp5ney9Ox7sG_ZjCNY-TNvpT7YmeOm_8lTGTGSnd4lumPIHiRlwSG_8IEa06SRg4rnz9kudM0Hnto2VsgZ4PtImQlGC3H8Zbw60Jrwvxw_fvxRkXeBOx5IdElMRKhvsRogA8me6-gSVIl8Q",
+            "scope": "openid profile email",
+            "id_token": "eyJraWQiOiJkZWZhdWx0UlNBU2lnbiIsImFsZyI6IlJTMjU2In0.eyJhdF9oYXNoIjoieTdUSjczeDNsbDF0ZEI5bU96RmtQUSIsInN1YiI6ImIwYTUwMmY2YWQ5MDQyN2YxZTZjYTdjODVhNzZjY2NiOGI5MzVhZjRkMjc1MDQyMTFhMDQwMGI0MmY5MGMxNDFAdW5pcHIuaXQiLCJhdWQiOiJvaWRjX2dpdGVhXzAxIiwiYXV0aF90aW1lIjoxNzg3MTI5ODQyLCJpc3MiOiJodHRwczovL3NoaWJpZHAudW5pcHIuaXQiLCJleHAiOjE3ODcxMzM0NDksImlhdCI6MTc4NzEyOTg0OSwic2lkIjoiX2UwMWJiZDkwMzQ5ODMzNDNkM2U0MmE5OTU5NDIyYmUzIn0.k5AQaood5q4ynRmYgC20cFV7cpBVrLwFC6Bi05PGvWFmnu5_u3nI4yAngM-u3qe7ILiJnsYsFuo3UUMowoJkycX5PveAo1x239_vK6Opp8VTQuCF4H8h4OmBjXj0eeCEQ3W00TUgV6S4rHU5NEvwiGR9ivEjZvVf1y2dzral7_DgX1KOQq5ZH5wma2Y5zM4el02pGEnPmi3P1zOXp1AQDx69cpZQj5UkKc15L8Y1yaJILMIDbsXgimSx1FGs_XA9bjSHdV2V25_h3TqsUxElwvb1uVk_kUqj06rDgORpnS_7Hg778GtW8kYZCz2kIYpYWi1h3tHhNnBOtHjxqepGyQ",
+            "token_type": "Bearer",
+            "expires_in": 600
+          }
@@ -0,0 +1,217 @@
+info:
+  name: Get OIDC well-known configuration
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: "{{serverUri}}/.well-known/openid-configuration"
+  auth: inherit
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+examples:
+  - name: Endpoints
+    request:
+      url: https://shibidp.unipr.it/.well-known/openid-configuration
+      method: GET
+    response:
+      status: 200
+      statusText: OK
+      headers:
+        - name: date
+          value: Wed, 19 Aug 2026 07:20:27 GMT
+        - name: server
+          value: Jetty(11.0.19)
+        - name: strict-transport-security
+          value: max-age=63072000; includeSubDomains, max-age=63072000 ; includeSubDomains ; preload
+        - name: x-content-type-options
+          value: nosniff
+        - name: x-frame-options
+          value: SAMEORIGIN, DENY
+        - name: expires
+          value: ""
+        - name: cache-control
+          value: no-store
+        - name: content-type
+          value: application/json;charset=utf-8
+        - name: content-security-policy
+          value: frame-ancestors 'none'; base-uri 'none'; script-src 'self' https://shibidp.unipr.it 'unsafe-inline';
+        - name: set-cookie
+          value: __Host-JSESSIONID=node01shvwd2kdnmjg1lxw0l50a24k060260.node0; Path=/; Secure; HttpOnly
+        - name: keep-alive
+          value: timeout=2, max=100
+        - name: connection
+          value: Keep-Alive
+        - name: transfer-encoding
+          value: chunked
+      body:
+        type: json
+        data: |-
+          {
+            "authorization_endpoint": "https://shibidp.unipr.it/idp/profile/oidc/authorize",
+            "token_endpoint": "https://shibidp.unipr.it/idp/profile/oidc/token",
+            "registration_endpoint": "https://shibidp.unipr.it/idp/profile/oidc/register",
+            "introspection_endpoint": "https://shibidp.unipr.it/idp/profile/oauth2/introspection",
+            "revocation_endpoint": "https://shibidp.unipr.it/idp/profile/oauth2/revocation",
+            "issuer": "https://shibidp.unipr.it",
+            "jwks_uri": "https://shibidp.unipr.it/idp/profile/oidc/keyset",
+            "scopes_supported": [
+              "openid",
+              "profile",
+              "email",
+              "spid",
+              "offline_access"
+            ],
+            "response_types_supported": [
+              "id_token",
+              "code",
+              "code id_token",
+              "code id_token token"
+            ],
+            "response_modes_supported": [
+              "query",
+              "fragment",
+              "form_post"
+            ],
+            "grant_types_supported": [
+              "authorization_code",
+              "implicit",
+              "refresh_token"
+            ],
+            "token_endpoint_auth_methods_supported": [
+              "client_secret_basic",
+              "client_secret_post",
+              "client_secret_jwt",
+              "private_key_jwt"
+            ],
+            "request_object_signing_alg_values_supported": [
+              "none",
+              "RS256",
+              "RS384",
+              "RS512",
+              "HS256",
+              "HS384",
+              "HS512",
+              "ES256",
+              "ES384",
+              "ES512"
+            ],
+            "request_parameter_supported": true,
+            "request_uri_parameter_supported": true,
+            "require_request_uri_registration": true,
+            "subject_types_supported": [
+              "public",
+              "pairwise"
+            ],
+            "userinfo_endpoint": "https://shibidp.unipr.it/idp/profile/oidc/userinfo",
+            "id_token_signing_alg_values_supported": [
+              "RS256",
+              "RS384",
+              "RS512",
+              "HS256",
+              "HS384",
+              "HS512",
+              "ES256",
+              "ES384",
+              "ES512",
+              "PS256",
+              "PS384",
+              "PS512"
+            ],
+            "id_token_encryption_alg_values_supported": [
+              "RSA1_5",
+              "RSA-OAEP",
+              "RSA-OAEP-256",
+              "RSA-OAEP-384",
+              "RSA-OAEP-512",
+              "A128KW",
+              "A192KW",
+              "A256KW",
+              "A128GCMKW",
+              "A192GCMKW",
+              "A256GCMKW",
+              "ECDH-ES",
+              "ECDH-ES+A128KW",
+              "ECDH-ES+A192KW",
+              "ECDH-ES+A256KW"
+            ],
+            "id_token_encryption_enc_values_supported": [
+              "A128CBC-HS256",
+              "A192CBC-HS384",
+              "A256CBC-HS512",
+              "A128GCM",
+              "A192GCM",
+              "A256GCM"
+            ],
+            "userinfo_signing_alg_values_supported": [
+              "RS256",
+              "RS384",
+              "RS512",
+              "HS256",
+              "HS384",
+              "HS512",
+              "ES256",
+              "ES384",
+              "ES512",
+              "PS256",
+              "PS384",
+              "PS512"
+            ],
+            "userinfo_encryption_alg_values_supported": [
+              "RSA1_5",
+              "RSA-OAEP",
+              "RSA-OAEP-256",
+              "RSA-OAEP-384",
+              "RSA-OAEP-512",
+              "A128KW",
+              "A192KW",
+              "A256KW",
+              "A128GCMKW",
+              "A192GCMKW",
+              "A256GCMKW",
+              "ECDH-ES",
+              "ECDH-ES+A128KW",
+              "ECDH-ES+A192KW",
+              "ECDH-ES+A256KW"
+            ],
+            "userinfo_encryption_enc_values_supported": [
+              "A128CBC-HS256",
+              "A192CBC-HS384",
+              "A256CBC-HS512",
+              "A128GCM",
+              "A192GCM",
+              "A256GCM"
+            ],
+            "display_values_supported": [
+              "page"
+            ],
+            "claims_supported": [
+              "aud",
+              "iss",
+              "sub",
+              "iat",
+              "exp",
+              "acr",
+              "auth_time",
+              "email",
+              "name",
+              "family_name",
+              "given_name",
+              "updated_at",
+              "codicefiscale",
+              "unipr_spid_email",
+              "spidName",
+              "spidFamilyName",
+              "spidCode",
+              "spidFiscalNumber",
+              "externalIDPLoA",
+              "externalIDPType",
+              "eduPersonScopedAffiliation"
+            ],
+            "claims_parameter_supported": true
+          }
@@ -0,0 +1,83 @@
+info:
+  name: Get UserInfo
+  type: http
+  seq: 4
+
+http:
+  method: GET
+  url: "{{serverUri}}/idp/profile/oidc/userinfo?client_id={{clientId}}&client_secret={{clientSecret}}"
+  headers:
+    - name: Content-Type
+      value: application/x-www-form-urlencoded
+  params:
+    - name: client_id
+      value: "{{clientId}}"
+      type: query
+    - name: client_secret
+      value: "{{clientSecret}}"
+      type: query
+  auth:
+    type: bearer
+    token: "{{accessToken}}"
+
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+examples:
+  - name: UserInfo data
+    request:
+      url: https://shibidp.unipr.it/idp/profile/oidc/userinfo?client_id={{shibbolethClientId}}&client_secret={{shibbolethClientSecret}}
+      method: GET
+      headers:
+        - name: Content-Type
+          value: application/x-www-form-urlencoded
+      params:
+        - name: client_id
+          value: "{{shibbolethClientId}}"
+          type: query
+        - name: client_secret
+          value: "{{shibbolethClientSecret}}"
+          type: query
+    response:
+      status: 200
+      statusText: OK
+      headers:
+        - name: date
+          value: Wed, 19 Aug 2026 08:58:14 GMT
+        - name: server
+          value: Jetty(11.0.19)
+        - name: strict-transport-security
+          value: max-age=63072000; includeSubDomains, max-age=63072000 ; includeSubDomains ; preload
+        - name: x-content-type-options
+          value: nosniff
+        - name: x-frame-options
+          value: SAMEORIGIN, DENY
+        - name: cache-control
+          value: no-store
+        - name: content-type
+          value: application/json;charset=utf-8
+        - name: content-security-policy
+          value: frame-ancestors 'none'; base-uri 'none'; script-src 'self' https://shibidp.unipr.it 'unsafe-inline';
+        - name: keep-alive
+          value: timeout=2, max=100
+        - name: connection
+          value: Keep-Alive
+        - name: transfer-encoding
+          value: chunked
+      body:
+        type: json
+        data: |-
+          {
+            "sub": "b0a502f6ad90427f1e6ca7c85a76cccb8b935af4d27504211a0400b42f90c141@unipr.it",
+            "codicefiscale": "MMMPPL74T17E463A",
+            "eduPersonScopedAffiliation": "staff@unipr.it alum@unipr.it member@unipr.it",
+            "name": "Pier Paolo MAMMI",
+            "eduPersonPrincipalName": "pierpaolo.mammi@unipr.it",
+            "given_name": "Pier Paolo",
+            "family_name": "MAMMI",
+            "matricola": "135097",
+            "email": "pierpaolo.mammi@unipr.it"
+          }
@@ -0,0 +1,17 @@
+name: Shibboleth
+variables:
+  - name: clientId
+    value: "{{process.env.client_id}}"
+    description: ""
+  - name: clientSecret
+    value: "{{process.env.client_secret}}"
+    description: ""
+  - name: redirectUri
+    value: https://gitea.unipr.it/user/oauth2/Shibboleth/callback
+    description: ""
+  - name: accessToken
+    value: AAdzZWNyZXQx1CToBgEqA8mxMWGsLKf0V86PS2Oz-3bI5BlRuiitj3iXP_qfSJgNzYsMdsIQ9QRmoIOS6ISVvFSyJ5XeHYE_msw6VJELg9S6qsO4mrBBwCaUM9p3zMPwNBwZJVn6vqgGghpMS_xeW2EGthh9W0HBsh7WuPYK4HJVpTYIxgYR782xET0ZU3XxLBknOeMoye2IrH3sYpeCRQCmd1GUyTl1Ra4sGdqYcw3iiISA_FbPMXOLFQN8GcFtEcPxzc9CtH4PHKDYIj_QQx0IUgEH814pyC-Oc5-19Gfg4Ulps9ZHF9rb4csbi9mvWAuJESHcSp5NSAK9tEMFvBUCe_2nr7WyzaGTI1D6Nr1PenxbWIRAmXGF5LtzSrv-8_k8XSdufefACBVbZH6EQWm4smrqSlMab71F5s9wB3rFEK5IuANQblFljG_vfoCATpmk0MCYo47SApSrorMYN5K6yWf4P3PuyQrIdrw0PsRzBWoY8XpzQTGYN1I
+    description: ""
+  - name: serverUri
+    value: https://shibidp.unipr.it
+    description: ""
@@ -0,0 +1,21 @@
+opencollection: 1.0.0
+
+info:
+  name: Shibboleth
+config:
+  proxy:
+    inherit: true
+    config:
+      protocol: http
+      hostname: ""
+      port: ""
+      auth:
+        username: ""
+        password: ""
+      bypassProxy: ""
+bundled: false
+extensions:
+  bruno:
+    ignore:
+      - node_modules
+      - .git