[JIRA] (JOIDC-64) Refactor client authentication on OAuth2 endpoints into a login flow

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNjM0ZDQ3YjgxMjEwNDBkODg1ZWZjOTVlZTYyOGQ5YzAiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/JOIDC-64?atlOrigin=eyJpIjoiNjM0ZDQ3YjgxMjEwNDBkODg1ZWZjOTVlZTYyOGQ5YzAiLCJwIjoiaiJ9 ) JOIDC-64 ( https://shibboleth.atlassian.net/browse/JOIDC-64?atlOrigin=eyJpIjoiNjM0ZDQ3YjgxMjEwNDBkODg1ZWZjOTVlZTYyOGQ5YzAiLCJwIjoiaiJ9 ) Refactor client authentication on OAuth2 endpoints into a login flow ( https://shibboleth.atlassian.net/browse/JOIDC-64?atlOrigin=eyJpIjoiNjM0ZDQ3YjgxMjEwNDBkODg1ZWZjOTVlZTYyOGQ5YzAiLCJwIjoiaiJ9 )

Issue Type: New Feature Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 14/Dec/21 10:57 AM Fix Versions: 3.1.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

To support other use cases and more general support for other client authentication methods, we want to leverage the existing IdP login flow machinery to handle client authn to the token, introspection, revocation, etc. endpoints.

Right now this is all handled by a single action bean in those flows. The most strictly correct thing would be to turn each client method into its login flow, but this gets hairy because of the overlaps with existing uses of some of those methods and the complexity of configuring it. For now I'm envisioning a single OAuth2 login flow that reuses as much of the existing code as possible and handles all the different types internally, but with more generality.

Part of this includes turning the existing metadata-backed client secret verification into a new CredentialValidator type so that it can be used in series with other validators such as LDAP. We could also try and support mutual TLS by including our existing validation bean for that. JWT mechanisms would be handled with custom actions based on the current design.

This needs to remain 100% backward compatible so that the configuration will default appropriately.

( https://shibboleth.atlassian.net/browse/JOIDC-64#add-comment?atlOrigin=eyJpIjoiNjM0ZDQ3YjgxMjEwNDBkODg1ZWZjOTVlZTYyOGQ5YzAiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-64#add-comment?atlOrigin=eyJpIjoiNjM0ZDQ3YjgxMjEwNDBkODg1ZWZjOTVlZTYyOGQ5YzAiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100186- sha1:84fa40f )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211214/03816392/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-9e55f333-8297-443e-8f18-da372c35f521
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211214/03816392/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-3a00b9c0-0d7a-4281-a162-286f1c6c8825
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211214/03816392/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-163e56ff-0050-433b-852a-3aa3f37ae246
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211214/03816392/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-09d13a32-6d21-479f-a6a0-14e04a493407
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211214/03816392/attachment-0007.png>