[JIRA] (JOIDC-78) Wrong JSONObject type when decoding claims from Signed JAR Authentication request

Wed Mar 9 20:24:28 UTC 2022

Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 ) *created* an issue

IdP Plugin - OIDC OP ( https://shibboleth.atlassian.net/browse/JOIDC?atlOrigin=eyJpIjoiNzQzYzliMTZmMTk1NDdhNGJmMWI0Zjk2M2U2MjVlY2YiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/JOIDC-78?atlOrigin=eyJpIjoiNzQzYzliMTZmMTk1NDdhNGJmMWI0Zjk2M2U2MjVlY2YiLCJwIjoiaiJ9 ) JOIDC-78 ( https://shibboleth.atlassian.net/browse/JOIDC-78?atlOrigin=eyJpIjoiNzQzYzliMTZmMTk1NDdhNGJmMWI0Zjk2M2U2MjVlY2YiLCJwIjoiaiJ9 ) Wrong JSONObject type when decoding claims from Signed JAR Authentication request ( https://shibboleth.atlassian.net/browse/JOIDC-78?atlOrigin=eyJpIjoiNzQzYzliMTZmMTk1NDdhNGJmMWI0Zjk2M2U2MjVlY2YiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 3.0.4 Assignee: Henri Mikkonen ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A1614c4a5-c89e-4edc-9421-990bd6ea85fd ) Created: 09/Mar/22 3:24 PM Priority: Trivial Reporter: Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 )

whiel experimenting with a custom client which used signed JAR requests to start authentication the claims seems to be ignored with this message:

Debugging the code seems to drill this down to: net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedClaimsLookupFunction:48

which tests “claims instanceof JSONObject” however:

* the claims Object is of class: com.nimbusds.jose.shaded.json.JSONObject
* whereas the JSONObject being tested is: net.minidev.json.JSONObject

here’s an example request (before being signed and incapsulated in threquest parameters):

{"iss":"demo_rp","response_type":"code","code_challenge_method":"S256","nonce":"-vFn_CJUfNC7FqJiXUI8Bj6YU16NhfRXZWqFfWsl6Vs","client_id":"demo_rp","aud":" https://op.mindmercatis.com","scope":"openid ( https://op.mindmercatis.com%22,%22scope%22:%22openid ) profile offline_access","acr_values":" https://www.spid.gov.it/SpidL1","claims":{"id_token":{"given_name":{"essential":true }} ,"userinfo":{"family_name":{"essential":true }}} ,"redirect_uri":"https://rp.mindmercatis.com/mockws/rp/postauth","state":"81c33d57-59c7-4b41-9a15-80e2ed1482e21646856869080","prompt":"consent","code_challenge":"UBkBqkYTEU0OIFf6T8F8dXWMWhEq_rWa-GXxKk1pLpY"} ( https://www.spid.gov.it/SpidL1%22,%22claims%22:%7B%22id_token%22:%7B%22given_name%22:%7B%22essential%22:true%7D%7D,%22userinfo%22:%7B%22family_name%22:%7B%22essential%22:true%7D%7D%7D,%22redirect_uri%22:%22https://rp.mindmercatis.com/mockws/rp/postauth%22,%22state%22:%2281c33d57-59c7-4b41-9a15-80e2ed1482e21646856869080%22,%22prompt%22:%22consent%22,%22code_challenge%22:%22UBkBqkYTEU0OIFf6T8F8dXWMWhEq_rWa-GXxKk1pLpY%22%7D )

here’s the actual auth request complete URL: https://op.mindmercatis.com/idp/profile/oidc/authorize?response_type=code&request=eyJraWQiOiJkZWZhdWx0UlNBU2lnbiIsImFsZyI6IlJTMjU2In0.eyJpc3MiOiJkZW1vX3JwIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJjb2RlX2NoYWxsZW5nZV9tZXRob2QiOiJTMjU2Iiwibm9uY2UiOiJrNXItVXdqdzBLS3IxOFhpS0QyVmJpTHREMmFkd3Q4NV9IaVN2ekJpOEZJIiwiY2xpZW50X2lkIjoiZGVtb19ycCIsImF1ZCI6Imh0dHBzOlwvXC9vcC5taW5kbWVyY2F0aXMuY29tIiwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBvZmZsaW5lX2FjY2VzcyIsImFjcl92YWx1ZXMiOiJodHRwczpcL1wvd3d3LnNwaWQuZ292Lml0XC9TcGlkTDEiLCJjbGFpbXMiOnsiaWRfdG9rZW4iOnsiZ2l2ZW5fbmFtZSI6eyJlc3NlbnRpYWwiOnRydWV9fSwidXNlcmluZm8iOnsiZmFtaWx5X25hbWUiOnsiZXNzZW50aWFsIjp0cnVlfX19LCJyZWRpcmVjdF91cmkiOiJodHRwczpcL1wvcnAubWluZG1lcmNhdGlzLmNvbVwvbW9ja3dzXC9ycFwvcG9zdGF1dGgiLCJzdGF0ZSI6IjgxYzMzZDU3LTU5YzctNGI0MS05YTE1LTgwZTJlZDE0ODJlMjE2NDY4NTczNDk1MzciLCJwcm9tcHQiOiJjb25zZW50IiwiY29kZV9jaGFsbGVuZ2UiOiJNaUFSLVV4Q2o2b1Z5UGF0Y1VucmIzTUdFWmJ3TEtCbUlSU29PS0xMVGwwIn0.BLkQxZKCldZ3plZoCcZzSnhzyJRDrKJLN7q1hEy1eIdybKYdallVNxZa-OHGVzrJhlH-H1OO0erve-CYyIgLXl4uIiHg2PZ4o3S3sIlcADDrkd_1nrmrou6hQ5aq1G-joVO3Th5kNMhZd37JDdFLgKgyIzkr0T4elD-gNmkqDsy6xR-8zWHGIfRCSrzxgGnnex0ROV7EDcgtCWb3YCQEDDnJrMygvMQ1Xix-r7TO4mSIbqBBbx4oQEcvQVSMfE_mBLAgBg8T4GSRO1mZjaf4n9vAdd500Db5NoNnc4R0s61BSqkdQdc6CR7wW1nOglsGnYeICUJ8uendLkxMsOlWOw&redirect_uri=https%3A%2F%2Frp.mindmercatis.com%2Fmockws%2Frp%2Fpostauth&client_id=demo_rp&scope=openid+profile+offline_access

( https://shibboleth.atlassian.net/browse/JOIDC-78#add-comment?atlOrigin=eyJpIjoiNzQzYzliMTZmMTk1NDdhNGJmMWI0Zjk2M2U2MjVlY2YiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-78#add-comment?atlOrigin=eyJpIjoiNzQzYzliMTZmMTk1NDdhNGJmMWI0Zjk2M2U2MjVlY2YiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100196- sha1:dfd693a )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220309/4a69ac82/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-90a3965c-d6a6-4ebb-ae6a-52690bdf7dc0
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220309/4a69ac82/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-b4b65120-04b5-4111-ab1e-1c77d6790a3f
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220309/4a69ac82/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-bbe737b3-21ea-4785-8104-db4f117efe30
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220309/4a69ac82/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-376a6a6e-332c-40c3-9303-eb223dac550b
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220309/4a69ac82/attachment-0007.png>