[JIRA] (JOIDC-62) Profile config support for bypassing attribute resolution not honored

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiOGRjYzg3ODQxNjYwNGRhNmFlNGE2M2FhZmMwNjBhZTEiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-62?atlOrigin=eyJpIjoiOGRjYzg3ODQxNjYwNGRhNmFlNGE2M2FhZmMwNjBhZTEiLCJwIjoiaiJ9 ) JOIDC-62 ( https://shibboleth.atlassian.net/browse/JOIDC-62?atlOrigin=eyJpIjoiOGRjYzg3ODQxNjYwNGRhNmFlNGE2M2FhZmMwNjBhZTEiLCJwIjoiaiJ9 ) Profile config support for bypassing attribute resolution not honored ( https://shibboleth.atlassian.net/browse/JOIDC-62?atlOrigin=eyJpIjoiOGRjYzg3ODQxNjYwNGRhNmFlNGE2M2FhZmMwNjBhZTEiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.0.0, 3.0.1, 3.0.2 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 09/Dec/21 2:07 PM Fix Versions: 3.1.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

There's a setting on the Authorization and Token profile configs for toggling attribute resolution off. I don't think it's being checked on either flow (and it's missing from the UserInfo config outright).

One option is just to deprecate and remove it, but it seems like it should be supportable. I think perhaps it's more complex than SAML because of the "sub" claim but I'm not sure if that strictly has to be resolved on the front channel if the response_type doesn't include id_token?

Somewhat the opposite of SAML, I would assume the token and userinfo endpoints could actually have resolution disabled if the encoding feature is used to tunnel everything desired through the tokens, perhaps not common or ideal but I would think functional? In which case the userinfo config would need that additional setting.

( https://shibboleth.atlassian.net/browse/JOIDC-62#add-comment?atlOrigin=eyJpIjoiOGRjYzg3ODQxNjYwNGRhNmFlNGE2M2FhZmMwNjBhZTEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-62#add-comment?atlOrigin=eyJpIjoiOGRjYzg3ODQxNjYwNGRhNmFlNGE2M2FhZmMwNjBhZTEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:f6eba4b )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211209/9ab39a2b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-26c3f6c9-0660-420e-a86c-2bb252ae753d
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211209/9ab39a2b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-c96c88ce-f6b1-4034-a9e8-e1ff0905833e
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211209/9ab39a2b/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-75ebf129-af02-4d98-bf6e-1e1986de9828
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211209/9ab39a2b/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-0b07b3b1-20f3-4ab3-9038-0b54e3260f97
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211209/9ab39a2b/attachment-0007.png>