[JIRA] (JOIDC-63) Missing required PKCE code challenges should raise an error in the authorization endpoint

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiMjY0OTUxOGIwMDk2NGJjNWI4ZTU2MDAxMjUzODUwNzYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-63?atlOrigin=eyJpIjoiMjY0OTUxOGIwMDk2NGJjNWI4ZTU2MDAxMjUzODUwNzYiLCJwIjoiaiJ9 ) JOIDC-63 ( https://shibboleth.atlassian.net/browse/JOIDC-63?atlOrigin=eyJpIjoiMjY0OTUxOGIwMDk2NGJjNWI4ZTU2MDAxMjUzODUwNzYiLCJwIjoiaiJ9 ) Missing required PKCE code challenges should raise an error in the authorization endpoint ( https://shibboleth.atlassian.net/browse/JOIDC-63?atlOrigin=eyJpIjoiMjY0OTUxOGIwMDk2NGJjNWI4ZTU2MDAxMjUzODUwNzYiLCJwIjoiaiJ9 )

Issue Type: Bug Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 10/Dec/21 9:09 AM Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

The OIDC.SSO profile can be configured to require PKCE. Currently the OP plugin only verifies this in the token endpoint when the authorization code is being exchanged into id_token and access token. That's not compliant with the spec, as the authorization endpoint must already return authorization error response with specific details, if the code challenge is missing (see 4.4.1 in [1] ).

[1] https://datatracker.ietf.org/doc/html/rfc7636

( https://shibboleth.atlassian.net/browse/JOIDC-63#add-comment?atlOrigin=eyJpIjoiMjY0OTUxOGIwMDk2NGJjNWI4ZTU2MDAxMjUzODUwNzYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-63#add-comment?atlOrigin=eyJpIjoiMjY0OTUxOGIwMDk2NGJjNWI4ZTU2MDAxMjUzODUwNzYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:f6eba4b )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211210/e2cfd4ce/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-d4063704-0fb1-4a3a-97d2-659e3d20ccd1
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211210/e2cfd4ce/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-9bcca884-bf2f-4935-b994-96d37bb9bf5f
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211210/e2cfd4ce/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-f108c5e4-53ff-432f-a29c-f300d4d636bc
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211210/e2cfd4ce/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-de361ea1-3f6a-4fe8-a443-d8c009581169
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211210/e2cfd4ce/attachment-0007.png>