[java-idp-oidc] branch main updated: JOIDC-32 Use of claims request parameter may cause NPE

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=cea4aa77d1635546bbd034324337b4463146a70e

The following commit(s) were added to refs/heads/main by this push:
       new  cea4aa77  JOIDC-32 Use of claims request parameter may cause NPE
cea4aa77 is described below

commit cea4aa77d1635546bbd034324337b4463146a70e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Feb 18 17:25:00 2021 +0200

    JOIDC-32 Use of claims request parameter may cause NPE
    
    https://issues.shibboleth.net/jira/browse/JOIDC-32
---
 .../impl/SetRequestedClaimsToResponseContext.java  | 30 +++++++++-------
 .../oidc/op/profile/flow/AuthorizeFlowTest.java    | 40 +++++++++++++++++++++-
 2 files changed, 56 insertions(+), 14 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
index 4e8aefef..b08218dd 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetRequestedClaimsToResponseContext.java
@@ -135,27 +135,31 @@ public class SetRequestedClaimsToResponseContext extends AbstractOIDCResponseAct
             // out.
             
             Multimap<String,IdPAttribute> results = HashMultimap.create();
-            for (final ClaimsSetRequest.Entry entry : cr.getIDTokenClaimsRequest().getEntries()) {
+            if (cr.getIDTokenClaimsRequest() != null) {
+                for (final ClaimsSetRequest.Entry entry : cr.getIDTokenClaimsRequest().getEntries()) {
                                 
-                final JSONObject wrapper = new JSONObject();
-                wrapper.put(entry.getClaimName(), entry);
-                
-                final Collection<TranscodingRule> transcodingRules =
-                        component.getComponent().getTranscodingRules(wrapper);
-                decodeAttribute(profileRequestContext, transcodingRules, wrapper, results);
+                    final JSONObject wrapper = new JSONObject();
+                    wrapper.put(entry.getClaimName(), entry);
+                    
+                    final Collection<TranscodingRule> transcodingRules =
+                            component.getComponent().getTranscodingRules(wrapper);
+                    decodeAttribute(profileRequestContext, transcodingRules, wrapper, results);
+                }
             }
             getOidcResponseContext().setMappedIdTokenRequestedClaims(results.isEmpty() ? null :
                     new AttributesMapContainer(results));
             
             results = HashMultimap.create();
-            for (final ClaimsSetRequest.Entry entry : cr.getUserInfoClaimsRequest().getEntries()) {
+            if (cr.getUserInfoClaimsRequest() != null) {
+                for (final ClaimsSetRequest.Entry entry : cr.getUserInfoClaimsRequest().getEntries()) {
                                 
-                final JSONObject wrapper = new JSONObject();
-                wrapper.put(entry.getClaimName(), entry);
+                    final JSONObject wrapper = new JSONObject();
+                    wrapper.put(entry.getClaimName(), entry);
                 
-                final Collection<TranscodingRule> transcodingRules =
-                        component.getComponent().getTranscodingRules(wrapper);
-                decodeAttribute(profileRequestContext, transcodingRules, wrapper, results);
+                    final Collection<TranscodingRule> transcodingRules =
+                            component.getComponent().getTranscodingRules(wrapper);
+                    decodeAttribute(profileRequestContext, transcodingRules, wrapper, results);
+                }
             }
             getOidcResponseContext().setMappedUserinfoRequestedClaims(results.isEmpty() ? null :
                 new AttributesMapContainer(results));
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index 5288a2c2..cd0fe9a1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -75,7 +75,45 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
         Assert.assertNull(successResponse.getAccessToken());
         Assert.assertNotNull(successResponse.getAuthorizationCode());
     }
+
+    @Test
+    public void testWithAuthorizationCodeFlowWithIDTokenClaims() throws IOException, ParseException, SessionException {
+        request.setMethod("GET");
+        request.setQueryString("client_id=mockClientId&response_type=code&scope=openid%20profile"
+                + "&claims=%7B%22id_token%22%3A%7B%22email%22%3A%7B%22essential%22%3Atrue%7D%7D%7D"
+                + "&redirect_uri=" + redirectUri);
+        storeMetadata(storageService, clientId, clientSecret, redirectUri);
+
+        initializeThreadLocals();
+        
+        FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        AuthenticationResponse responseMessage = parseSuccessResponse(result, AuthenticationResponse.class);
+        AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
+        Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
+        Assert.assertNull(successResponse.getIDToken());
+        Assert.assertNull(successResponse.getAccessToken());
+        Assert.assertNotNull(successResponse.getAuthorizationCode());
+    }
     
+    @Test
+    public void testWithAuthorizationCodeFlowWithUIClaims() throws IOException, ParseException, SessionException {
+        request.setMethod("GET");
+        request.setQueryString("client_id=mockClientId&response_type=code&scope=openid%20profile"
+                + "&claims=%7B%22userinfo%22%3A%7B%22email%22%3A%7B%22essential%22%3Atrue%7D%7D%7D"
+                + "&redirect_uri=" + redirectUri);
+        storeMetadata(storageService, clientId, clientSecret, redirectUri);
+
+        initializeThreadLocals();
+
+        FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        AuthenticationResponse responseMessage = parseSuccessResponse(result, AuthenticationResponse.class);
+        AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
+        Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
+        Assert.assertNull(successResponse.getIDToken());
+        Assert.assertNull(successResponse.getAccessToken());
+        Assert.assertNotNull(successResponse.getAuthorizationCode());
+    }
+
     @Test
     public void testWithAuthorizationCodeFlowUsingSAMLMetadata() throws IOException, ParseException, SessionException {
         request.setMethod("GET");
@@ -84,7 +122,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
         storeMetadata(storageService, clientId, clientSecret, redirectUri);
 
         initializeThreadLocals();
-        
+
         FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
         AuthenticationResponse responseMessage = parseSuccessResponse(result, AuthenticationResponse.class);
         AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.