[JIRA] (JOIDC-71) Lack of openid scope in metadata doesn't prevent id_token issuance

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNDkyMWU5NzBkNzM1NDY0ZjllNWJkZDAyMjllMTgzNDgiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-71?atlOrigin=eyJpIjoiNDkyMWU5NzBkNzM1NDY0ZjllNWJkZDAyMjllMTgzNDgiLCJwIjoiaiJ9 ) JOIDC-71 ( https://shibboleth.atlassian.net/browse/JOIDC-71?atlOrigin=eyJpIjoiNDkyMWU5NzBkNzM1NDY0ZjllNWJkZDAyMjllMTgzNDgiLCJwIjoiaiJ9 ) Lack of openid scope in metadata doesn't prevent id_token issuance ( https://shibboleth.atlassian.net/browse/JOIDC-71?atlOrigin=eyJpIjoiNDkyMWU5NzBkNzM1NDY0ZjllNWJkZDAyMjllMTgzNDgiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 05/Jan/22 10:38 AM Fix Versions: 3.1.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

We have anomalous behavior in the unexpected case that the metadata doesn't authorize any scopes, at least with regard to the special openid scope. On the authorize endpoint, you typically might not get a sub claim out, preventing anything from "working", but the only barrier to it working is really the attribute release policy.

Assuming you got a sub claim out, you'd possibly get at least a valid authz code (if not other response types), and on the token endpoint, it doesn't prevent issuance of the tokens if the openid scope is missing.

I will commit unit tests documenting these outcomes so that they can be adjusted if the code changes.

Note that it should be possible to change the metadata in between those steps and that should be honored, so even if a sub claim were present and a code issued correctly, if the metadata changes to disallow openid scope, we'd want that to be enforced. So each flow should be doing the right thing without basing the answer on what already happened.

( https://shibboleth.atlassian.net/browse/JOIDC-71#add-comment?atlOrigin=eyJpIjoiNDkyMWU5NzBkNzM1NDY0ZjllNWJkZDAyMjllMTgzNDgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-71#add-comment?atlOrigin=eyJpIjoiNDkyMWU5NzBkNzM1NDY0ZjllNWJkZDAyMjllMTgzNDgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100187- sha1:319aa7c )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220105/679a373f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-540f1326-bd1d-442e-9089-5dad71d3cdf0
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220105/679a373f/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-ab004ec9-ba71-432d-a445-dd9cf299516c
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220105/679a373f/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-20874821-52b6-40d7-903c-5fa059695083
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220105/679a373f/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b35a73b8-1964-44f9-9cd3-1c2d280ecfff
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220105/679a373f/attachment-0007.png>