[java-idp-oidc] branch dev/JOIDC-7 updated: Seal type claim and remove redirect_uri from access tokens.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/JOIDC-7
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=174d52ff83e6a889f0373d0431e26a28f7214a4e

The following commit(s) were added to refs/heads/dev/JOIDC-7 by this push:
     new 174d52ff Seal type claim and remove redirect_uri from access tokens.
174d52ff is described below

commit 174d52ff83e6a889f0373d0431e26a28f7214a4e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Apr 27 10:18:30 2022 -0400

    Seal type claim and remove redirect_uri from access tokens.
---
 .../idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java |  2 --
 .../plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java   | 10 +++++-----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
index bf34d641..0bce7967 100644
--- a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/token/support/AccessTokenClaimsSet.java
@@ -184,7 +184,6 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
             setIssuedAt(issuedAt);
             setExpiresAt(expiresAt);
             setAuthenticationTime(authenticationTime);
-            setRedirectURI(redirectURI);
             setScope(scope);
         }
         
@@ -228,7 +227,6 @@ public final class AccessTokenClaimsSet extends TokenClaimsSet {
             setNotBefore(existing.getNotBefore());
             setAuthenticationTime(existing.getAuthenticationTime());
             setAudience(existing.getAudience());
-            setRedirectURI(existing.getRedirectURI());
             setClaimsRequest(existing.getClaimsRequest());
             setConsentedClaims(existing.getConsentedClaims());
             setConsentEnabled(existing.isConsentEnabled());
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
index 9017f8c7..55a783ed 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
@@ -453,11 +453,7 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
                     .setNonce(authenticationRequest.getNonce())
                     .setClaimsRequest(authenticationRequest.getOIDCClaims());
             }
-
-            if (responseCtx.getRedirectURI() != null) {
-                builder.setRedirectURI(responseCtx.getRedirectURI());
-            }
-}
+        }
         
         if (jwtTokenType && responseCtx.getAccessTokenClaimSet() != null) {
             builder.setCustomClaims(responseCtx.getAccessTokenClaimSet().toJSONObject());
@@ -496,6 +492,10 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
 
         // Put the claims to hide here.
         final Map<String,Object> toSeal = new HashMap<>();
+
+        if (map.containsKey(TokenClaimsSet.KEY_TYPE)) {
+            toSeal.put(TokenClaimsSet.KEY_TYPE, map.remove(TokenClaimsSet.KEY_TYPE));
+        }
         
         if (map.containsKey(TokenClaimsSet.KEY_USER_PRINCIPAL)) {
             toSeal.put(TokenClaimsSet.KEY_USER_PRINCIPAL, map.remove(TokenClaimsSet.KEY_USER_PRINCIPAL));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.