[java-idp-oidc] branch main updated: Handle null Scope in response context.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=04021bfd3cda0ddb002e501304619cf76ed5aa94

The following commit(s) were added to refs/heads/main by this push:
     new 04021bfd Handle null Scope in response context.
04021bfd is described below

commit 04021bfd3cda0ddb002e501304619cf76ed5aa94
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 5 08:51:38 2022 -0500

    Handle null Scope in response context.
---
 .../idp/plugin/oidc/op/profile/impl/RevokeConsent.java  | 17 ++++++++++-------
 .../impl/SetAuthorizationCodeToResponseContext.java     |  6 ++++--
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java
index 4f99e86d..6c1087f3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/RevokeConsent.java
@@ -25,6 +25,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.openid.connect.sdk.OIDCScopeValue;
 import com.nimbusds.openid.connect.sdk.Prompt;
 
@@ -65,15 +66,17 @@ public class RevokeConsent extends AbstractOIDCResponseAction {
     /** {@inheritDoc} */
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
-        if (getOidcResponseContext().getScope().contains(OIDCScopeValue.OFFLINE_ACCESS)) {
+        
+        final Scope scope = getOidcResponseContext().getScope();
+        if (scope != null && getOidcResponseContext().getScope().contains(OIDCScopeValue.OFFLINE_ACCESS)) {
             log.debug("{} Pre-existing consent revoked as offline_access scope is requested", getLogPrefix());
             profileRequestContext.getSubcontext(ConsentManagementContext.class, true).setRevokeConsent(true);
-            return;
-        }
-        final Prompt prompt = promptLookupStrategy.apply(profileRequestContext);
-        if (prompt != null && prompt.contains(Prompt.Type.CONSENT)) {
-            log.debug("{} Pre-existing consent revoked as user consent is requested", getLogPrefix());
-            profileRequestContext.getSubcontext(ConsentManagementContext.class, true).setRevokeConsent(true);
+        } else {
+            final Prompt prompt = promptLookupStrategy.apply(profileRequestContext);
+            if (prompt != null && prompt.contains(Prompt.Type.CONSENT)) {
+                log.debug("{} Pre-existing consent revoked as user consent is requested", getLogPrefix());
+                profileRequestContext.getSubcontext(ConsentManagementContext.class, true).setRevokeConsent(true);
+            }
         }
     }
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
index 3e22d403..a409130e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/SetAuthorizationCodeToResponseContext.java
@@ -29,6 +29,7 @@ import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 import net.minidev.json.JSONArray;
 import net.shibboleth.idp.authn.context.SubjectContext;
@@ -284,18 +285,19 @@ public class SetAuthorizationCodeToResponseContext extends AbstractOIDCAuthentic
             claimsUI = tokenClaimsCtx.getUserinfoClaims();
         }
         final Instant dateExp = Instant.now().plus(authzCodeLifetime);
+        final Scope scope = getOidcResponseContext().getScope();
         final AuthorizeCodeClaimsSet claimsSet = new AuthorizeCodeClaimsSet.Builder(idGenerator,
                 getAuthenticationRequest().getClientID(), issuerLookupStrategy.apply(profileRequestContext),
                 subjectCtx.getPrincipalName(), getOidcResponseContext().getSubject(), Instant.now(), dateExp,
                 getOidcResponseContext().getAuthTime(), getOidcResponseContext().getRedirectURI(),
-                getOidcResponseContext().getScope()).setACR(getOidcResponseContext().getAcr())
+                scope != null ? scope : new Scope()).setACR(getOidcResponseContext().getAcr())
                         .setNonce(new DefaultRequestNonceLookupFunction().apply(profileRequestContext))
                         .setClaims(getOidcResponseContext().getRequestedClaims()).setDlClaims(claims)
                         .setDlClaimsID(claimsID).setDlClaimsUI(claimsUI).setConsentedClaims(consented)
                         .setCodeChallenge(codeChallenge)
                         .setConsentEnabled(consentEnabledPredicate.test(profileRequestContext)).build();
         // We set token claims set to response context for possible access token generation.
-        getOidcResponseContext().setTokenClaimsSet(claimsSet);
+        getOidcResponseContext().setAuthorizationGrantClaimsSet(claimsSet);
         try {
             getOidcResponseContext().setAuthorizationCode(claimsSet.serialize(dataSealer));
             log.debug("{} Setting authz code {} as {} to response context ", getLogPrefix(), claimsSet.serialize(),

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.