[java-idp-oidc] branch main updated: Switch to invalid_target error code per RFC.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=2bee76356486812fe0cb01ba3872baa053e5d530

The following commit(s) were added to refs/heads/main by this push:
     new 2bee7635 Switch to invalid_target error code per RFC.
2bee7635 is described below

commit 2bee76356486812fe0cb01ba3872baa053e5d530
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 17 09:40:32 2022 -0500

    Switch to invalid_target error code per RFC.
---
 .../idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java   | 7 ++++---
 .../idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml        | 4 ++++
 .../oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java       | 5 +++--
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
index eaa4a8e0..0b926b34 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateAudience.java
@@ -41,6 +41,7 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultOIDCMet
 import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAudienceLookupFunction;
 import net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractOIDCAuthenticationResponseAction;
 import net.shibboleth.idp.profile.context.navigate.RelyingPartyIdLookupFunction;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
@@ -57,7 +58,7 @@ import net.shibboleth.utilities.java.support.logic.Constraint;
  * 
  * @event {@link EventIds#PROCEED_EVENT_ID}
  * @event {@link EventIds#INVALID_PROFILE_CTX}
- * @event {@link EventIds#ACCESS_DENIED}
+ * @event {@link OidcEventIds#INVALID_TARGET}
  */
 public class ValidateAudience extends AbstractOIDCAuthenticationResponseAction {
 
@@ -152,7 +153,7 @@ public class ValidateAudience extends AbstractOIDCAuthenticationResponseAction {
         final List<String> allowedAudience = allowedAudienceLookupStrategy.apply(profileRequestContext);
         if (allowedAudience == null || allowedAudience.isEmpty()) {
             log.warn("{} No allowed audience for client {}", getLogPrefix(), clientId);
-            ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
+            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_TARGET);
             return;
         }
         
@@ -195,7 +196,7 @@ public class ValidateAudience extends AbstractOIDCAuthenticationResponseAction {
         
         if (effectiveAudience.isEmpty()) {
             log.warn("{} No allowed audience for client {}", getLogPrefix(), clientId);
-            ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
+            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_TARGET);
             return;
         }
         
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
index e2fc9f96..98b9e258 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
@@ -45,6 +45,10 @@
             
         <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).REVOCATION_FAILED}"
             value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).SERVER_ERROR}" />
+
+        <!-- Missing from Nimbus. -->
+        <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_TARGET}"
+            value="#{T(net.shibboleth.oidc.profile.core.OidcError).INVALID_TARGET}" />
     </util:map>
 
 </beans>
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 04fff47c..73de8e7e 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -64,6 +64,7 @@ import com.nimbusds.oauth2.sdk.token.AccessToken;
 import net.shibboleth.idp.plugin.oidc.op.profile.impl.BaseOIDCResponseActionTest;
 import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
 import net.shibboleth.idp.plugin.oidc.op.token.support.TokenClaimsSet;
+import net.shibboleth.oidc.profile.core.OidcError;
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullElements;
 import net.shibboleth.utilities.java.support.collection.Pair;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
@@ -121,7 +122,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
         storeMetadata(storageService, clientId, clientSecret, null);
         setBasicAuth(clientId, clientSecret);
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        assertErrorCode(result, OAuth2Error.ACCESS_DENIED_CODE);
+        assertErrorCode(result, OidcError.INVALID_TARGET_CODE);
     }
 
     @Test
@@ -156,7 +157,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
         setHttpFormRequest("POST", createRequestParameters(clientId, scope, resource + "/invalid"));
         setBasicAuth(clientId, clientSecret);
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        assertErrorCode(result, OAuth2Error.ACCESS_DENIED_CODE);
+        assertErrorCode(result, OidcError.INVALID_TARGET_CODE);
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.