[JIRA] (JOIDC-97) support C_HASH in ID_Token also for Authorization Code Flow with PKCE

[Henri Mikkonen (Jira)]

Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) *commented* on JOIDC-97 ( https://shibboleth.atlassian.net/browse/JOIDC-97?atlOrigin=eyJpIjoiNjAxMDAwZDhiMjVmNGNjYWE3OWRiNzcyYjdhYTg5NmQiLCJwIjoiaiJ9 )

Re: support C_HASH in ID_Token also for Authorization Code Flow with PKCE ( https://shibboleth.atlassian.net/browse/JOIDC-97?atlOrigin=eyJpIjoiNjAxMDAwZDhiMjVmNGNjYWE3OWRiNzcyYjdhYTg5NmQiLCJwIjoiaiJ9 )

Refactored *AddAuthorizationCodeHashToIDToken* to exploit newly added helper functions when calculating the *c_hash* value. The helper functions may be used together with the IDTokenManipulationStrategy profile configuration (see https://shibboleth.atlassian.net/browse/JOIDC-104 ) in order to include *c_hash* value to the *id_token* also when it's not mandated by the spec.

For instance the following script can be used for including c_hash in the token endpoint:

<bean id="ComputeAuthorizationCodeHashFunction" class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultComputeAuthorizationCodeHashFunction">
 <property name="securityParametersLookupStrategy">
   <bean parent="shibboleth.Functions.Compose"
     c:g-ref="shibboleth.ChildLookup.SecurityParameters"
     c:f-ref="shibboleth.ChildLookup.RelyingParty" />
 </property>
 <property name="authorizationCodeLookupStrategy">
   <bean class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestAuthorizationCodeLookupFunction" />
 </property>
</bean>

<bean id="testIDTokenManipulation" parent="shibboleth.BiFunctions.Scripted" p:customObject-ref="ComputeAuthorizationCodeHashFunction" factory-method="inlineScript">
 <constructor-arg name="scriptSource">
   <value>
     <![CDATA[
       var result = null;
       var codeHash = custom.apply(input1);
       if (codeHash != null) {
         var newMapType = Java.type("java.util.HashMap");
         var newMap = new newMapType();
         newMap.putAll(input2);
         newMap.put("c_hash", codeHash);
         result = newMap;
       }
       result;
     ]]>
   </value>
 </constructor-arg>
</bean>

The script above can be wired to a OAUTH2.Token profile in the following way in relying-party.xml:

...
  <bean parent="OAUTH2.Token.MDDriven" p:iDTokenManipulationStrategy-ref="testIDTokenManipulation" />
...

Note that this example only works in the token endpoint with authorization code grant. The id_token may also be produced via refresh tokens: in that case the c_hash value must be calculated in the similar way when the authorization code is around, and then stored into refresh tokens via mechanism implemented in https://shibboleth.atlassian.net/browse/JOIDC-111.

( https://shibboleth.atlassian.net/browse/JOIDC-97#add-comment?atlOrigin=eyJpIjoiNjAxMDAwZDhiMjVmNGNjYWE3OWRiNzcyYjdhYTg5NmQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-97#add-comment?atlOrigin=eyJpIjoiNjAxMDAwZDhiMjVmNGNjYWE3OWRiNzcyYjdhYTg5NmQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100200- sha1:9199305 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220610/6ef6740f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e333b5a0-eb20-446b-a4a7-569359d76db7
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220610/6ef6740f/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-9aff0d6e-ee0e-476c-8258-37fa407e9171
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220610/6ef6740f/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f8fbc577-d920-4755-bd7f-620230165d62
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220610/6ef6740f/attachment-0005.png>