[JIRA] (JOIDC-124) refresh_token & audience

[Florian Ritterhoff (Jira)]

Florian Ritterhoff ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=622f440e1c09d2007012f8f1 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiMDJiY2U0ZGU4OTVlNGQyM2FhMTBkM2E2YjlmYjhjMzYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-124?atlOrigin=eyJpIjoiMDJiY2U0ZGU4OTVlNGQyM2FhMTBkM2E2YjlmYjhjMzYiLCJwIjoiaiJ9 ) JOIDC-124 ( https://shibboleth.atlassian.net/browse/JOIDC-124?atlOrigin=eyJpIjoiMDJiY2U0ZGU4OTVlNGQyM2FhMTBkM2E2YjlmYjhjMzYiLCJwIjoiaiJ9 ) refresh_token & audience ( https://shibboleth.atlassian.net/browse/JOIDC-124?atlOrigin=eyJpIjoiMDJiY2U0ZGU4OTVlNGQyM2FhMTBkM2E2YjlmYjhjMzYiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.2.1 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Attachments: 0001-Include-audience-in-refresh_token.patch Components: Token Endpoint Created: 14/Aug/22 2:52 AM Priority: Trivial Reporter: Florian Ritterhoff ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=622f440e1c09d2007012f8f1 )

In case of requesting a access_token and a refresh_token with an additional audience it is not possible to use the provided refresh_token to gather a new access_token containg the previously granted audience.

According to the rfc8707 this should be possible. From my point of view this is caused due to the missing audience information in the (sealed) refresh_token and can be prevented including this information. A possible fix and an additional test is attached to this bug report.

( https://shibboleth.atlassian.net/browse/JOIDC-124#add-comment?atlOrigin=eyJpIjoiMDJiY2U0ZGU4OTVlNGQyM2FhMTBkM2E2YjlmYjhjMzYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-124#add-comment?atlOrigin=eyJpIjoiMDJiY2U0ZGU4OTVlNGQyM2FhMTBkM2E2YjlmYjhjMzYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100204- sha1:2343019 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220814/fbc854bf/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-9a8a96cf-d8e5-437e-be6d-0b394705e546
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220814/fbc854bf/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-5235fc85-ca61-4eec-bec8-f80efd561e89
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220814/fbc854bf/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-68efd793-d0a8-49ce-8ebc-c6cf3ec5d597
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220814/fbc854bf/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-6e5c912c-aac1-45fa-b065-6a33dd5e0586
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220814/fbc854bf/attachment-0007.png>