[JIRA] (JOIDC-68) Request object (JWT) validation is incomplete

Mon Jan 3 13:28:14 UTC 2022

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *resolved* as *Fixed*

The ClaimsValidators now verifies exp and nbf claims for all (signed or plain) request objects, if they're present in the JWT. For signed request objects, iss and aud are required and always verified. All the cases are covered by the unit tests (also authorize-flow test).

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNDQ0MGI0M2M0MzRhNDQyNjg4ZTliZWM1MzllYTUxMTgiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-68?atlOrigin=eyJpIjoiNDQ0MGI0M2M0MzRhNDQyNjg4ZTliZWM1MzllYTUxMTgiLCJwIjoiaiJ9 ) JOIDC-68 ( https://shibboleth.atlassian.net/browse/JOIDC-68?atlOrigin=eyJpIjoiNDQ0MGI0M2M0MzRhNDQyNjg4ZTliZWM1MzllYTUxMTgiLCJwIjoiaiJ9 ) Request object (JWT) validation is incomplete ( https://shibboleth.atlassian.net/browse/JOIDC-68?atlOrigin=eyJpIjoiNDQ0MGI0M2M0MzRhNDQyNjg4ZTliZWM1MzllYTUxMTgiLCJwIjoiaiJ9 )

Change By: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Resolution: Fixed Status: Open Resolved

( https://shibboleth.atlassian.net/browse/JOIDC-68#add-comment?atlOrigin=eyJpIjoiNDQ0MGI0M2M0MzRhNDQyNjg4ZTliZWM1MzllYTUxMTgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-68#add-comment?atlOrigin=eyJpIjoiNDQ0MGI0M2M0MzRhNDQyNjg4ZTliZWM1MzllYTUxMTgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100187- sha1:76abc0a )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220103/39f47370/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-2c33a1f6-de55-4115-a788-9af1bdc275d8
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220103/39f47370/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-5b0ccc99-8f67-4399-9882-34e3a9c598fc
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220103/39f47370/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-4e70ed39-171b-4769-a937-a53f3297a1ff
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220103/39f47370/attachment-0005.png>