[java-idp-oidc] branch main updated: JOIDC-47 - Authorize-endpoit may unnecessarily include claims in id_token in hybrid OIDC flow

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=54407ff410caf7443550521a8574e1c3ab22ffd7

The following commit(s) were added to refs/heads/main by this push:
       new  54407ff4  JOIDC-47 - Authorize-endpoit may unnecessarily include claims in id_token in hybrid OIDC flow
54407ff4 is described below

commit 54407ff410caf7443550521a8574e1c3ab22ffd7
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 21 14:39:23 2021 +0300

    JOIDC-47 - Authorize-endpoit may unnecessarily include claims in id_token in hybrid OIDC flow
    
    https://issues.shibboleth.net/jira/browse/JOIDC-47
    
    Set addToIDTokenByDefault to true only when response_type=id_token.
---
 .../idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
index 9ebd0601..fd52950a 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
@@ -61,6 +61,7 @@ import org.slf4j.LoggerFactory;
 
 import com.nimbusds.oauth2.sdk.ResponseType;
 import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
+import com.nimbusds.openid.connect.sdk.OIDCResponseTypeValue;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 
 /**
@@ -284,8 +285,9 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
         if (targetIDToken) {
             final Object msg = profileRequestContext.getInboundMessageContext().getMessage();
             if (msg instanceof AuthenticationRequest) {
-                addToIDTokenByDefault =
-                        !((AuthenticationRequest) msg).getResponseType().contains(ResponseType.Value.TOKEN);
+                final ResponseType responseType = ((AuthenticationRequest) msg).getResponseType();
+                addToIDTokenByDefault = responseType.contains(OIDCResponseTypeValue.ID_TOKEN)
+                        && responseType.size() == 1;
             }
 
             alwaysIncludedAttributes = alwaysIncludedAttributesLookupStrategy.apply(profileRequestContext);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.