[java-idp-oidc] branch main updated: JOIDC-79 - Claims-parameter in the authn request only affects attribute filtering

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=9c05c9bee1b7f68f50092f329adc1d4aa6970a66

The following commit(s) were added to refs/heads/main by this push:
     new 9c05c9be JOIDC-79 - Claims-parameter in the authn request only affects attribute filtering
9c05c9be is described below

commit 9c05c9bee1b7f68f50092f329adc1d4aa6970a66
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Mar 16 13:04:39 2022 +0200

    JOIDC-79 - Claims-parameter in the authn request only affects attribute filtering
    
    https://shibboleth.atlassian.net/browse/JOIDC-79
---
 .../op/profile/impl/AddAttributesToClaimsSet.java  | 11 +++++++--
 .../profile/impl/AddAttributesToClaimsSetTest.java | 27 ++++++++++++++++++++++
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
index d44dae6c..2c92c468 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSet.java
@@ -29,6 +29,7 @@ import javax.annotation.Nullable;
 
 import net.minidev.json.JSONObject;
 import net.shibboleth.idp.attribute.AttributeEncodingException;
+import net.shibboleth.idp.attribute.AttributesMapContainer;
 import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.context.AttributeContext;
 import net.shibboleth.idp.attribute.transcoding.AttributeTranscoder;
@@ -374,8 +375,14 @@ public class AddAttributesToClaimsSet extends AbstractOIDCResponseAction {
                 // Check for claims to skip based on token type.
                 if (claimsSet instanceof IDTokenClaimsSet && !addToIDTokenByDefault
                         && !alwaysIncludedAttributes.contains(attribute.getId())) {
-                    log.debug("{} Attribute {} not targeted for ID Token", getLogPrefix(), attribute.getId());
-                    continue;
+                    final AttributesMapContainer container = getOidcResponseContext().getMappedIdTokenRequestedClaims();
+                    if (container != null && container.get().containsKey(attribute.getId())) {
+                        log.debug("{} Attribute {} is targeted for ID Token via claims request", getLogPrefix(),
+                                attribute.getId());
+                    } else {
+                        log.debug("{} Attribute {} not targeted for ID Token", getLogPrefix(), attribute.getId());
+                        continue;
+                    }
                 } else if (claimsSet instanceof UserInfo && deniedUserInfoAttributes.contains(attribute.getId())) {
                     log.debug("{} Attribute {} not targeted for Userinfo Token", getLogPrefix(), attribute.getId());
                     continue;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
index 02fc13da..8a9390c1 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddAttributesToClaimsSetTest.java
@@ -27,6 +27,7 @@ import java.util.Map;
 import java.util.Set;
 
 import net.shibboleth.ext.spring.testing.MockApplicationContext;
+import net.shibboleth.idp.attribute.AttributesMapContainer;
 import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.IdPAttributeValue;
 import net.shibboleth.idp.attribute.StringAttributeValue;
@@ -54,6 +55,8 @@ import org.testng.annotations.AfterMethod;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import com.google.common.collect.HashMultimap;
+import com.google.common.collect.Multimap;
 import com.nimbusds.oauth2.sdk.ParseException;
 
 /** {@link AddAttributesToClaimsSet} unit test. */
@@ -128,6 +131,7 @@ public class AddAttributesToClaimsSetTest extends BaseOIDCResponseActionTest {
         attribute1.setValues(stringAttributeValues1);
 
         // Attribute to be encoded to id token only in implicit "id_token" case
+        // (unless requested in claims-request)
         final IdPAttribute attribute2 = new IdPAttribute("test2");
         final List<IdPAttributeValue> stringAttributeValues2 = new ArrayList<>();
         stringAttributeValues2.add(new StringAttributeValue("value"));
@@ -207,6 +211,29 @@ public class AddAttributesToClaimsSetTest extends BaseOIDCResponseActionTest {
         Assert.assertNull(respCtx.getIDToken().getClaim("test5claim"));
     }
 
+    /**
+     * Success case without consent information. Claim 'test2' is requested and thus must be included in the id_token.
+     * 
+     * @throws ComponentInitializationException
+     * @throws ParseException
+     */
+    @Test
+    public void testSuccessNoConsentWithTest2Request() throws ComponentInitializationException, ParseException {
+        setIdTokenToResponseContext("iss", "sub", "aud", Instant.now(), Instant.now());
+        final Multimap<String,IdPAttribute> map = HashMultimap.create();
+        map.put("test2", new IdPAttribute("test2"));
+        final AttributesMapContainer container = new AttributesMapContainer(map);
+        respCtx.setMappedIdTokenRequestedClaims(container);
+        setAttributeContext();
+        final Event event = action.execute(requestCtx);
+        ActionTestingSupport.assertProceedEvent(event);
+        Assert.assertTrue(respCtx.getIDToken().getClaim("test1").equals("value1 value2"));
+        Assert.assertTrue(respCtx.getIDToken().getClaim("test2").equals("value"));
+        Assert.assertTrue(respCtx.getIDToken().getClaim("test3claim").equals("value3"));
+        Assert.assertTrue(respCtx.getIDToken().getClaim("test4claim").equals("value4"));
+        Assert.assertNull(respCtx.getIDToken().getClaim("test5claim"));
+    }
+
     /**
      * Success case with consent information.
      * 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.