[java-idp-plugin-duo] branch main updated: Add a final check the redirect_uri is not null

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=91d99c458b9c6fa9214dd76fec29746764eed44f

The following commit(s) were added to refs/heads/main by this push:
       new  91d99c4   Add a final check the redirect_uri is not null
91d99c4 is described below

commit 91d99c458b9c6fa9214dd76fec29746764eed44f
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 12 16:34:21 2021 +0000

    Add a final check the redirect_uri is not null
    
     - Given this is caught in the integration, it would only occur if that
    behaviour changed, or a custom one used. Even then it would be caught by
    the JWS request builder - it is just a more clear place to put it.
---
 .../idp/plugin/authn/duo/nimbus/impl/NimbusClient.java   | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
index 959305e..71e49d4 100644
--- a/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
+++ b/idp-duo-nimbus-client-impl/src/main/java/net/shibboleth/idp/plugin/authn/duo/nimbus/impl/NimbusClient.java
@@ -136,6 +136,11 @@ public final class NimbusClient extends AbstractDuoOIDCClient{
             final String redirectURI = redirectURIOverride != null ? 
                     redirectURIOverride : duoIntegration.getRedirectURI();
             
+            if (redirectURI == null) {
+                throw new DuoClientException("A redirect_uri was not supplied but is required "
+                        + "for creating an authorization request, for client '"+duoIntegration.getClientId()+"'");
+            }
+            
             final String request = NimbusClientSupport.createJWSRequestObject(
                     duoIntegration.getClientId(), redirectURI, duoIntegration.getSecretKey(), state, username);
             
@@ -167,12 +172,19 @@ public final class NimbusClient extends AbstractDuoOIDCClient{
                     .setPath(duoIntegration.getTokenEndpoint()).build();            
             log.trace("Using authorization endpoint and audience '{}'",uri);
             
+            final String redirectURI = redirectURIOverride != null ? 
+                    redirectURIOverride : duoIntegration.getRedirectURI();
+            
+            if (redirectURI == null) {
+                throw new DuoClientException("A redirect_uri was not supplied but is required "
+                        + "for acquiring a 2FA result, for client '"+duoIntegration.getClientId()+"'");
+            }
+            
             final RequestBuilder rb =
                     RequestBuilder.post().setUri(uri)
                     .addParameter("grant_type","authorization_code")
                     .addParameter("code",code)
-                    .addParameter("redirect_uri",redirectURIOverride != null 
-                                ? redirectURIOverride : duoIntegration.getRedirectURI())
+                    .addParameter("redirect_uri",redirectURI)
                     .addParameter("client_assertion_type",CLIENT_ASSERTION_TYPE)
                     .addParameter("client_assertion",
                             NimbusClientSupport.createJWS(uri.toString(),duoIntegration.getClientId(),

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.