[JIRA] (JOIDC-70) Narrowing scopes by request parameters not supported

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiY2JhZmYxNGFiMjc0NGIwYTgzZjYzNGRkOGE0ZWI2MjMiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-70?atlOrigin=eyJpIjoiY2JhZmYxNGFiMjc0NGIwYTgzZjYzNGRkOGE0ZWI2MjMiLCJwIjoiaiJ9 ) JOIDC-70 ( https://shibboleth.atlassian.net/browse/JOIDC-70?atlOrigin=eyJpIjoiY2JhZmYxNGFiMjc0NGIwYTgzZjYzNGRkOGE0ZWI2MjMiLCJwIjoiaiJ9 ) Narrowing scopes by request parameters not supported ( https://shibboleth.atlassian.net/browse/JOIDC-70?atlOrigin=eyJpIjoiY2JhZmYxNGFiMjc0NGIwYTgzZjYzNGRkOGE0ZWI2MjMiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 04/Jan/22 5:45 PM Fix Versions: 3.1.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

The scope validation logic is flawed in a couple of ways:

* There are code paths that assume the Scope field in the OIDC response context object is non-null, but it's typed as nullable and the code path involving no scopes registered in metadata will lead to a null value there. That's probably not exploitable because something might cause it to bail out earlier, but it did come up in my testing once I made other changes. It's possible the unit tests just don't produce that case.
* The more significant issue is that the spec allows requests to the token endpoint to pass a scope parameter that overrides any pre-existing scope in the code or token as long as it's a subset. I imagine that doesn't come up much if they don't even test for it during certification.

The fix happens to be required to make the client_credentials grant work since the only scope input there is the token request itself, triggering all these edge cases to start appearing.

( https://shibboleth.atlassian.net/browse/JOIDC-70#add-comment?atlOrigin=eyJpIjoiY2JhZmYxNGFiMjc0NGIwYTgzZjYzNGRkOGE0ZWI2MjMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-70#add-comment?atlOrigin=eyJpIjoiY2JhZmYxNGFiMjc0NGIwYTgzZjYzNGRkOGE0ZWI2MjMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100187- sha1:319aa7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220104/11f199e3/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-df7a84a0-906a-45f2-bae1-257a2f85d85b
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220104/11f199e3/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-93437beb-451c-4aa0-976e-00c9fc8dc9a8
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220104/11f199e3/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-5ab52c60-0cbd-46a4-abee-13cc084add68
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220104/11f199e3/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-ba27651c-a638-4ec8-b7f4-ceccc7612731
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220104/11f199e3/attachment-0007.png>