[java-idp-oidc] branch main updated: Tighten error handling for scope/audience.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=586d6e65b0dbd4a01179bfe957ca4bfc16bb5a4e

The following commit(s) were added to refs/heads/main by this push:
     new 586d6e65 Tighten error handling for scope/audience.
586d6e65 is described below

commit 586d6e65b0dbd4a01179bfe957ca4bfc16bb5a4e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jan 19 11:50:21 2022 -0500

    Tighten error handling for scope/audience.
---
 .../op/oauth2/profile/impl/BuildAccessToken.java   | 22 +++++++---
 .../oauth2/profile/impl/BuildAccessTokenTest.java  | 51 +++++++++++++++++++++-
 2 files changed, 66 insertions(+), 7 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
index d4a60429..baca3a62 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessToken.java
@@ -378,6 +378,10 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
         log.debug("{} Building access token with audience: {}", getLogPrefix(), audience);
 
         final Scope scope = getScope(ctx.getScope());
+        if (scope == null) {
+            ActionSupport.buildEvent(profileRequestContext, EventIds.ACCESS_DENIED);
+            return;
+        }
         log.debug("{} Building access token with scope: {}", getLogPrefix(), scope);
 
         final Instant now = Instant.now();
@@ -439,9 +443,12 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
             }
             
             log.warn("{} No source attribute {} available to produce scope claim", getLogPrefix(), scopeAttribute);
+            return null;
         }
         
-        log.debug("{} Using originally requested/validated scope", getLogPrefix());
+        if (validatedScope != null) {
+            log.debug("{} Using originally requested/validated scope", getLogPrefix());
+        }
         return validatedScope;
     }
     
@@ -456,13 +463,18 @@ public class BuildAccessToken extends AbstractOIDCResponseAction {
                         .map(StringAttributeValue::getValue)
                         .collect(Collectors.toUnmodifiableList());
             }
+            
+            log.warn("{} No source attribute {} available to produce audience claim", getLogPrefix(),
+                    audienceAttribute);
+            return null;
         }
         
-        log.debug("{} Using originally requested resource(s) as audience", getLogPrefix());
-        if (tokenRequest.getResources() == null) {
-            return null;
+        if (tokenRequest.getResources() != null && !tokenRequest.getResources().isEmpty()) {
+            log.debug("{} Using originally requested resource(s) as audience", getLogPrefix());
+            return tokenRequest.getResources().stream().map(URI::toString).collect(Collectors.toUnmodifiableList());
         }
-        return tokenRequest.getResources().stream().map(URI::toString).collect(Collectors.toUnmodifiableList());
+        
+        return null;
     }
 
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
index f23f63b3..4faef1cf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/BuildAccessTokenTest.java
@@ -17,7 +17,9 @@
 
 package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
 
-import static org.testng.Assert.*;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
 
 import net.shibboleth.idp.attribute.EmptyAttributeValue;
 import net.shibboleth.idp.attribute.EmptyAttributeValue.EmptyType;
@@ -63,7 +65,7 @@ import com.nimbusds.oauth2.sdk.id.ClientID;
 
 // Checkstyle: ThrowsCount OFF
 
-/** {@link SetAccessTokenToResponseContext} unit test. */
+/** {@link BuildAccessToken} unit test. */
 public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
 
     /** Action to test. */
@@ -149,6 +151,51 @@ public class BuildAccessTokenTest extends BaseOIDCResponseActionTest {
         final Event event = action.execute(requestCtx);
         ActionTestingSupport.assertEvent(event, EventIds.ACCESS_DENIED);
     }
+
+
+    /**
+     * Test no source of audience claim from attribute.
+     * 
+     * @throws ParseException 
+     * @throws DataSealerException 
+     * @throws ComponentInitializationException 
+     * @throws NoSuchAlgorithmException
+     * @throws URISyntaxException 
+     */
+    @Test
+    public void testNoAudienceFromAttribute() throws ParseException, DataSealerException,
+            ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
+
+        initAction(null, null, "aud");
+
+        final AttributeContext attributeCtx = rpCtx.getSubcontext(AttributeContext.class, true);
+        attributeCtx.setUnfilteredIdPAttributes(Collections.singletonList(new IdPAttribute("aud")));
+        
+        final Event event = action.execute(requestCtx);
+        ActionTestingSupport.assertEvent(event, EventIds.ACCESS_DENIED);
+    }
+
+    /**
+     * Test no source of scope claim from attribute.
+     * 
+     * @throws ParseException 
+     * @throws DataSealerException 
+     * @throws ComponentInitializationException 
+     * @throws NoSuchAlgorithmException
+     * @throws URISyntaxException 
+     */
+    @Test
+    public void testNoScopeFromAttribute() throws ParseException, DataSealerException,
+            ComponentInitializationException, NoSuchAlgorithmException, URISyntaxException {
+
+        initAction(null, "scope", null);
+
+        final AttributeContext attributeCtx = rpCtx.getSubcontext(AttributeContext.class, true);
+        attributeCtx.setUnfilteredIdPAttributes(Collections.singletonList(new IdPAttribute("foo")));
+        
+        final Event event = action.execute(requestCtx);
+        ActionTestingSupport.assertEvent(event, EventIds.ACCESS_DENIED);
+    }
     
     /**
      * Basic success case, direct reuse of requested scope/audience.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.