[JIRA] (JOIDC-68) Request object (JWT) validation is incomplete

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiOTIzMzZjN2NlOGQ4NDA5OThhYWFiOGQ1Mzg4ZDJlMjQiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-68?atlOrigin=eyJpIjoiOTIzMzZjN2NlOGQ4NDA5OThhYWFiOGQ1Mzg4ZDJlMjQiLCJwIjoiaiJ9 ) JOIDC-68 ( https://shibboleth.atlassian.net/browse/JOIDC-68?atlOrigin=eyJpIjoiOTIzMzZjN2NlOGQ4NDA5OThhYWFiOGQ1Mzg4ZDJlMjQiLCJwIjoiaiJ9 ) Request object (JWT) validation is incomplete ( https://shibboleth.atlassian.net/browse/JOIDC-68?atlOrigin=eyJpIjoiOTIzMzZjN2NlOGQ4NDA5OThhYWFiOGQ1Mzg4ZDJlMjQiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.0.0, 3.0.1, 3.0.2 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 30/Dec/21 6:50 AM Fix Versions: 3.0.3 Priority: Trivial Reporter: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd )

The plugin already supports passing request parameters as JWTs, as defined by the section 6 of the OIDC core spec [1]. The spec concentrates on authorization/authentication request claims, and explicitly mentions only two (iss and aud) of the generic claims defined in the JWT RFC (7519) [2] : iss, sub, aud, exp, nbf, iat and jti.

Currently the plugin only verifies the signature and client_id/response_type claims as mandated by the spec, but at least iss, aud, exp and nbf should be verified. As single request object may be used multiple times, verification of iat and jti claims don't don't feel meaningful.

[1] https://openid.net/specs/openid-connect-core-1_0.html
[2] https://datatracker.ietf.org/doc/html/rfc7519

( https://shibboleth.atlassian.net/browse/JOIDC-68#add-comment?atlOrigin=eyJpIjoiOTIzMzZjN2NlOGQ4NDA5OThhYWFiOGQ1Mzg4ZDJlMjQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-68#add-comment?atlOrigin=eyJpIjoiOTIzMzZjN2NlOGQ4NDA5OThhYWFiOGQ1Mzg4ZDJlMjQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100187- sha1:76abc0a )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211230/a383b0f8/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-1ab733c5-3b4b-46a4-a0bf-eb61f579aa7c
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211230/a383b0f8/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-bf1ad947-e9e5-461a-b937-1bbab986d10a
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211230/a383b0f8/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-a9e7493b-b015-4f7b-a5e1-6f9408c3f7ef
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211230/a383b0f8/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e7cc4705-5cbd-429f-a1ef-f844df7c6d38
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211230/a383b0f8/attachment-0007.png>