[java-idp-oidc] 01/02: Improved logging: exploit client_id from metadata too.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=71929023a60f4fefd824705ff4fdf9cfacfbb37a

commit 71929023a60f4fefd824705ff4fdf9cfacfbb37a
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Apr 20 21:08:13 2022 +0300

    Improved logging: exploit client_id from metadata too.
---
 .../impl/ValidateClientAuthenticationType.java     | 23 +++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/ValidateClientAuthenticationType.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/ValidateClientAuthenticationType.java
index 4b40da4e..b5ac7bd2 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/ValidateClientAuthenticationType.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/authn/impl/ValidateClientAuthenticationType.java
@@ -140,7 +140,7 @@ public class ValidateClientAuthenticationType extends AbstractAuthenticationActi
             @Nonnull final AuthenticationContext authenticationContext) {
         
         final ClientAuthenticationMethod registeredMethod;
-        
+
         // Pull the client's registered authn method, or default to client_secret_basic.
         // If no metadata exists, leave null.
         if (oidcMetadataContext != null && oidcMetadataContext.getClientInformation() != null) {
@@ -156,10 +156,9 @@ public class ValidateClientAuthenticationType extends AbstractAuthenticationActi
 
         final ClientAuthenticationMethod used =
                 clientAuthentication != null ? clientAuthentication.getMethod() : ClientAuthenticationMethod.NONE;
-        
+
         if (registeredMethod != null && !registeredMethod.equals(used)) {
-            log.warn("{} Client '{}' registered {} but attempted {}", getLogPrefix(),
-                    clientAuthentication != null ? clientAuthentication.getClientID() : "<Unknown>",
+            log.warn("{} Client '{}' registered {} but attempted {}", getLogPrefix(), getClientID(),
                     registeredMethod, used);
             ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
         } else if (!enabledMethods.contains(used)) {
@@ -167,5 +166,19 @@ public class ValidateClientAuthenticationType extends AbstractAuthenticationActi
             ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
         }
     }
-    
+
+    /**
+     * Parses the client ID from OIDC metadata or client authentication, if exists.
+     * 
+     * @return client ID, or null it it couldn't be found.
+     */
+    @Nullable private String getClientID() {
+        if (oidcMetadataContext != null && oidcMetadataContext.getClientInformation() != null) {
+            return oidcMetadataContext.getClientInformation().getID().getValue();
+        }
+        if (clientAuthentication != null && clientAuthentication.getClientID() != null) {
+            return clientAuthentication.getClientID().getValue();
+        }
+        return null;
+    }
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.