[JIRA] (JOIDC-91) PKCE no longer working

Ryan Larscheidt (Jira) jira at shibboleth.atlassian.net
Tue Apr 19 03:18:17 UTC 2022 

Ryan Larscheidt ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Aab074778-c2f6-4990-adb0-8e58e646ad76 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiYTdlNWVjYTAzNjBjNGRlMDk1ZDNlYWVmZmY5NmE3MTYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-91?atlOrigin=eyJpIjoiYTdlNWVjYTAzNjBjNGRlMDk1ZDNlYWVmZmY5NmE3MTYiLCJwIjoiaiJ9 ) JOIDC-91 ( https://shibboleth.atlassian.net/browse/JOIDC-91?atlOrigin=eyJpIjoiYTdlNWVjYTAzNjBjNGRlMDk1ZDNlYWVmZmY5NmE3MTYiLCJwIjoiaiJ9 ) PKCE no longer working ( https://shibboleth.atlassian.net/browse/JOIDC-91?atlOrigin=eyJpIjoiYTdlNWVjYTAzNjBjNGRlMDk1ZDNlYWVmZmY5NmE3MTYiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.1.0 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Components: Token Endpoint Created: 18/Apr/22 11:18 PM Environment:

* IdP 4.2.1
* OIDC Common 2.0.0
* OIDC OP 3.1.0

Priority: Trivial Reporter: Ryan Larscheidt ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Aab074778-c2f6-4990-adb0-8e58e646ad76 )

After updating to OIDC OP 3.1.0 we’re getting “invalid_client: Client authentication failed” errors for OIDC clients that use the Authorization Code with PKCE flow. I’m testing with mod_auth_openidc RP with OIDCPKCEMethod set to “S256” and registered using the following client metadata:

{
   "client_id": "test-pkce-client",
   "grant_types":["authorization_code", "refresh_token"],
   "redirect_uris": ["https://localhost:444/redirect_uri"],
   "response_types": ["code"],
   "scope": "openid profile email offline_access",
   "token_endpoint_auth_method": "none"
}

and the following relying-party.xml config:

<bean parent="RelyingPartyByName" c:relyingPartyIds="# {{ 'test-pkce-client' }} ">
   <property name="profileConfigurations">
       <list>
           <bean parent="OIDC.SSO" />
           <bean parent="OIDC.UserInfo" />
           <bean parent="OAUTH2.Revocation"
                 p:tokenEndpointAuthMethods="none" />
           <bean parent="OAUTH2.Token"
                 p:tokenEndpointAuthMethods="none" />
       </list>
   </property>
</bean>

I tried with OIDC.SSO and OAUTH2.Token, neither worked. Below are the parameters that the IdP sees in the token request as reported by OIDCTokenRequestDecoder:

Parameters:
	code:<redacted>
	grant_type:authorization_code
	redirect_uri:https://localhost:444/redirect_uri
	code_verifier:<redacted>
	client_id:test-pkce-client

Here are the log lines immediately following that:

DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.OIDCMetadataLookupHandler:121] - Message Handler:  net.shibboleth.oidc.metadata.context.OIDCMetadataContext added to MessageContext as child of org.opensaml.messaging.context.MessageContext
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeRelyingPartyContext:162] - Attaching RelyingPartyContext for test-pkce-client
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeRelyingPartyContext:168] - Profile Action InitializeRelyingPartyContext: Setting the rp context verified
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParameters:231] - Profile Action PopulateOIDCSignatureSigningParameters: Signing enabled
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParametersHandler:221] - Message Handler:  Signing enabled
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParametersHandler:234] - Message Handler:  Resolving SignatureSigningParameters for request
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParametersHandler:268] - Message Handler:  Adding OIDC client information to resolution criteria for signing/digest algorithms
DEBUG [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver:186] - Resolving SignatureSigningParameters, purpose token endpoint jwt signature validation
DEBUG [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver:219] - No client secret to use as a key
DEBUG [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver:240] - No keyset available
DEBUG [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver:271] - Not able to resolve signature validation credential based on provided client information
DEBUG [net.shibboleth.idp.plugin.oidc.op.security.impl.OIDCClientInformationSignatureValidationParametersResolver:298] - Validation failure: Unable to resolve signature validation credential
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.PopulateOIDCSignatureSigningParametersHandler:281] - Message Handler:  Failed to resolve SignatureSigningParameters
DEBUG [net.shibboleth.idp.plugin.oidc.op.authn.impl.ExtractClientAuthenticationFromRequest:98] - Profile Action ExtractClientAuthenticationFromRequest: No OAuth client credentials in request
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/OAuth2Client to intermediate set
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed

Let me know if there’s any additional information I can provide.

( https://shibboleth.atlassian.net/browse/JOIDC-91#add-comment?atlOrigin=eyJpIjoiYTdlNWVjYTAzNjBjNGRlMDk1ZDNlYWVmZmY5NmE3MTYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-91#add-comment?atlOrigin=eyJpIjoiYTdlNWVjYTAzNjBjNGRlMDk1ZDNlYWVmZmY5NmE3MTYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220419/454309ce/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-41598325-d3b0-4f1b-b129-7c771ad0cbbe
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220419/454309ce/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-bd5f97df-fddd-4c8a-be70-02bb4a7e5328
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220419/454309ce/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-37519fda-e73a-416e-ab76-b354c0261d76
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220419/454309ce/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-92d422ea-718f-4c91-af39-d15e9b2ba117
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220419/454309ce/attachment-0007.png>

More information about the commits mailing list