[java-idp-oidc] branch main updated: Take response_mode into account also for error messages from authorize-endpoint.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=d5411d750cb30b480895abe8d91ae5b994964dac

The following commit(s) were added to refs/heads/main by this push:
       new  d5411d75  Take response_mode into account also for error messages from authorize-endpoint.
d5411d75 is described below

commit d5411d750cb30b480895abe8d91ae5b994964dac
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Sun Mar 21 23:18:03 2021 +0200

    Take response_mode into account also for error messages from authorize-endpoint.
    
    The following rules were not followed before for error messages:
    
    implicit: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#id_token
    hybrid: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#rfc.section.5
---
 .../impl/BuildAuthenticationErrorResponseFromEvent.java  | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
index 2fcd354c..14ead389 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/BuildAuthenticationErrorResponseFromEvent.java
@@ -22,9 +22,12 @@ import java.net.URI;
 import org.opensaml.profile.context.EventContext;
 import org.opensaml.profile.context.ProfileRequestContext;
 import com.nimbusds.oauth2.sdk.ErrorObject;
+import com.nimbusds.oauth2.sdk.ResponseMode;
+import com.nimbusds.oauth2.sdk.ResponseType;
 import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
 
 import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction;
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseTypeLookupFunction;
 import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestStateLookupFunction;
 import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.ValidatedRedirectURILookupFunction;
 
@@ -44,9 +47,18 @@ public class BuildAuthenticationErrorResponseFromEvent
             // No validated redirect uri to return reply to.
             return null;
         }
+        final ResponseMode defaultResponseMode = 
+                new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext);
+        final ResponseType responseType = new DefaultRequestResponseTypeLookupFunction().apply(profileRequestContext);
+        final ResponseMode responseMode;
+        if (responseType != null && (responseType.impliesHybridFlow() || responseType.impliesImplicitFlow())) {
+            responseMode = defaultResponseMode == null ? ResponseMode.FRAGMENT :
+                defaultResponseMode == ResponseMode.QUERY ? ResponseMode.FRAGMENT : defaultResponseMode;
+        } else {
+            responseMode = defaultResponseMode;
+        }
         return new AuthenticationErrorResponse(redirectURI, error,
-                new DefaultRequestStateLookupFunction().apply(profileRequestContext),
-                new DefaultRequestResponseModeLookupFunction().apply(profileRequestContext));
+                new DefaultRequestStateLookupFunction().apply(profileRequestContext), responseMode);
     }
 
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.