[java-idp-oidc] branch main updated: JOIDC-21 - Use token authentication for OIDC dynamic client registration

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=8d83d5db1ff976ddfd7e79fd75382a69371b53ce

The following commit(s) were added to refs/heads/main by this push:
     new 8d83d5db JOIDC-21 - Use token authentication for OIDC dynamic client registration
8d83d5db is described below

commit 8d83d5db1ff976ddfd7e79fd75382a69371b53ce
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Apr 1 10:47:05 2022 +0300

    JOIDC-21 - Use token authentication for OIDC dynamic client registration
    
    https://shibboleth.atlassian.net/browse/JOIDC-21
    
    Changed the registration issuance action to error if no metadata policy can
    be resolved from the given location. The location still doesn't need to be
    specified if the policy ID is specified.
---
 .../admin/impl/IssueRegistrationAccessToken.java   | 19 +++++++++++++++++--
 .../impl/IssueRegistrationAccessTokenTest.java     | 22 +++++++++++++++++++---
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessToken.java
index bb41f5ee..56935cab 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessToken.java
@@ -340,6 +340,8 @@ public class IssueRegistrationAccessToken extends AbstractAdminApiProfileAction
         }
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -369,6 +371,13 @@ public class IssueRegistrationAccessToken extends AbstractAdminApiProfileAction
             policyLocation = policyLocationLookupStrategy.apply(profileRequestContext);
             policyId = policyIdLookupStrategy.apply(profileRequestContext);
             metadataPolicy = metadataPolicyLookupStrategy.apply(profileRequestContext);
+            if (policyLocation != null && metadataPolicy == null) {
+                log.warn("{} No metadata policy could be resolved from the given location: {}", getLogPrefix(),
+                        policyLocation);
+                sendError(HttpServletResponse.SC_BAD_REQUEST,
+                        "Invalid Request", "No metadata policy or policy ID could be resolved.");
+                return false;
+            }
             if (metadataPolicy == null && policyId == null) {
                 log.warn("{} No metadata policy or policy ID could be resolved", getLogPrefix());
                 sendError(HttpServletResponse.SC_BAD_REQUEST,
@@ -401,7 +410,9 @@ public class IssueRegistrationAccessToken extends AbstractAdminApiProfileAction
         
         return true;
     }
-    
+
+    // Checkstyle: CyclomaticComplexity ON
+
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
@@ -455,6 +466,8 @@ public class IssueRegistrationAccessToken extends AbstractAdminApiProfileAction
         profileRequestContext.setOutboundMessageContext(mc);
     }
 
+    // Checkstyle: CyclomaticComplexity OFF
+
     /**
      * Check access policies.
      * 
@@ -513,7 +526,9 @@ public class IssueRegistrationAccessToken extends AbstractAdminApiProfileAction
         
         return true;
     }
-    
+
+    // Checkstyle: CyclomaticComplexity ON
+
     /**
      * Decorate the token with authentication-related claims.
      * 
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessTokenTest.java
index 1752ed75..620219d2 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/admin/impl/IssueRegistrationAccessTokenTest.java
@@ -28,7 +28,6 @@ import java.util.Map;
 
 import javax.servlet.ServletRequest;
 
-import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -157,7 +156,7 @@ public class IssueRegistrationAccessTokenTest {
     }
 
     @Test
-    public void testNoMetadataPolicy() throws ComponentInitializationException, JsonMappingException,
+    public void testNoMetadataPolicyNorId() throws ComponentInitializationException, JsonMappingException,
             JsonProcessingException, UnsupportedEncodingException {
         action = new IssueRegistrationAccessToken();
         action.setSealer(dataSealer);
@@ -172,7 +171,24 @@ public class IssueRegistrationAccessTokenTest {
         assertErrorResponse(400, "Invalid Request");
         
     }
-    
+
+    @Test
+    public void testInvalidMetadataPolicyLocation() throws ComponentInitializationException, JsonMappingException,
+            JsonProcessingException, UnsupportedEncodingException {
+        action = new IssueRegistrationAccessToken();
+        action.setSealer(dataSealer);
+        action.setObjectMapper(objectMapper);
+        action.setAccessControlService(accessControlService);
+        action.setPolicyLocationLookupStrategy(FunctionSupport.constant("not_existing_location"));
+        action.setMetadataPolicyLookupStrategy(FunctionSupport.constant(null));
+        action.setIssuerLookupStrategy(FunctionSupport.constant(issuer));
+        initRequestResponse();
+        action.initialize();
+        requestCtx.getFlowScope().put(IssueRegistrationAccessTokenArguments.URL_PARAM_LIFETIME, lifetime);
+        ActionTestingSupport.assertProceedEvent(action.execute(requestCtx));
+        assertErrorResponse(400, "Invalid Request");
+    }
+
     @Test
     public void testNoTokenLifetime() throws DataSealerException, JsonMappingException, JsonProcessingException {
         requestCtx.getFlowScope().put(IssueRegistrationAccessTokenArguments.URL_PARAM_POLICY_ID,

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.