[java-idp-oidc] branch main updated: JOIDC-134 - endpointURI logging issue
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Nov 25 12:44:48 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=e0c0c23a3da59bab6621c25fed83d04f9ea7591e
The following commit(s) were added to refs/heads/main by this push:
new e0c0c23a JOIDC-134 - endpointURI logging issue
e0c0c23a is described below
commit e0c0c23a3da59bab6621c25fed83d04f9ea7591e
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 25 14:42:45 2022 +0200
JOIDC-134 - endpointURI logging issue
https://shibboleth.atlassian.net/browse/JOIDC-134
New property 'idp.oidc.logging.removeIpAddressFromProtocolMessage' can
be used for removing protocol-scheme, IP-address and port for endpointURI
in PROTOCOL_MESSAGE.OAUTH2 logging. Defaults to false.
---
.../impl/OIDCAuthenticationRequestDecoder.java | 2 +-
.../impl/OIDCClientRegistrationRequestDecoder.java | 2 +-
.../op/decoding/impl/OIDCTokenRequestDecoder.java | 2 +-
.../decoding/impl/OIDCUserInfoRequestDecoder.java | 2 +-
.../decoding/impl/BaseOAuth2RequestDecoder.java | 35 ++++++++++++++++++++++
.../impl/OAuth2AuthorizationRequestDecoder.java | 2 +-
.../impl/OAuth2IntrospectionRequestDecoder.java | 2 +-
.../impl/OAuth2RevocationRequestDecoder.java | 2 +-
.../oauth2/introspection/introspection-beans.xml | 3 +-
.../flows/oauth2/revocation/revocation-beans.xml | 3 +-
.../idp/flows/oidc/authorize/authorize-beans.xml | 6 ++--
.../idp/flows/oidc/register/register-beans.xml | 3 +-
.../idp/flows/oidc/token/token-beans.xml | 3 +-
.../idp/flows/oidc/userinfo/userinfo-beans.xml | 3 +-
.../idp/plugin/oidc/op/conf/oidc.properties | 4 ++-
15 files changed, 59 insertions(+), 15 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java
index aa1a40d5..79600d59 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCAuthenticationRequestDecoder.java
@@ -67,7 +67,7 @@ public class OIDCAuthenticationRequestDecoder extends BaseOAuth2RequestDecoder<A
.add("codeChallengeMethod", message.getCodeChallengeMethod())
.add("customParameters", message.getCustomParameters())
.add("display", message.getDisplay())
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.add("idTokenHint", message.getIDTokenHint() == null ? null : message.getIDTokenHint().serialize())
.add("loginHint", message.getLoginHint())
.add("nonce", message.getNonce())
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java
index 5d8c7109..5589d15e 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCClientRegistrationRequestDecoder.java
@@ -77,7 +77,7 @@ public class OIDCClientRegistrationRequestDecoder extends BaseOAuth2RequestDecod
return message == null ? null : MoreObjects.toStringHelper(this).omitNullValues()
.add("accessToken", RequestUtil.getAccessTokenLog(message.getAccessToken()))
.add("clientMetadata", message.getClientMetadata())
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.add("oidcClientMetadata", message.getOIDCClientMetadata())
.add("softwareStatement", message.getSoftwareStatement() == null ? null :
message.getSoftwareStatement().serialize())
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java
index ace4221d..88c597eb 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java
@@ -63,7 +63,7 @@ public class OIDCTokenRequestDecoder extends BaseOAuth2RequestDecoder<TokenReque
.add("clientAuthentication", RequestUtil.getClientAuthenticationLog(message.getClientAuthentication()))
.add("clientId", message.getClientID())
.add("customParameters", message.getCustomParameters())
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.add("existingGrant", RequestUtil.getRefreshTokenLog(message.getExistingGrant()))
.add("resources", message.getResources())
.add("scope", message.getScope())
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCUserInfoRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCUserInfoRequestDecoder.java
index d80f9088..21380187 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCUserInfoRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCUserInfoRequestDecoder.java
@@ -60,7 +60,7 @@ public class OIDCUserInfoRequestDecoder extends BaseOAuth2RequestDecoder<UserInf
return message == null ? null : MoreObjects.toStringHelper(this).omitNullValues()
.add("accessToken", RequestUtil.getAccessTokenLog(message.getAccessToken()))
.add("method", message.getMethod())
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.toString();
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
index e4c175ab..3662eff3 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/BaseOAuth2RequestDecoder.java
@@ -17,6 +17,8 @@
package net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl;
+import java.net.URI;
+
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -28,6 +30,8 @@ import org.slf4j.LoggerFactory;
import com.nimbusds.oauth2.sdk.Request;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
+
/**
* Base decoder for Nimbus OAuth2 request messages.
*
@@ -42,6 +46,21 @@ public abstract class BaseOAuth2RequestDecoder<T extends Request> extends Abstra
/** Used to log protocol messages. */
@Nonnull private final Logger protocolMessageLog = LoggerFactory.getLogger("PROTOCOL_MESSAGE.OAUTH2");
+ /** A flag to remove the IP address from the endpoint URI. */
+ private boolean removeIpAddressFromEndpointUri;
+
+ /**
+ * Set the flag to remove the IP address from the endpoint URI.
+ *
+ * @param flag What to set.
+ */
+ public synchronized void setRemoveIpAddressFromEndpointUri(final boolean flag) {
+ ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+ ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
+
+ removeIpAddressFromEndpointUri = flag;
+ }
+
/** {@inheritDoc} */
@Override
protected void doDecode() throws MessageDecodingException {
@@ -82,4 +101,20 @@ public abstract class BaseOAuth2RequestDecoder<T extends Request> extends Abstra
* @return the string representing the protocol message for logging purposes
*/
@Nullable protected abstract String getMessageToLog(final T message);
+
+ /**
+ * Returns the endpoint URI either from servlet request or from the given message, depending on the flag for
+ * removing IP address from the endpoint URI.
+ *
+ * @param message the message from which to take the endpoint URI (with IP address), if the flag is false
+ * @return the endpoint URI
+ */
+ @Nullable protected String getEndpointURI(final T message) {
+ if (removeIpAddressFromEndpointUri) {
+ return getHttpServletRequest().getRequestURI();
+ } else {
+ final URI endpointUri = message.getEndpointURI();
+ return endpointUri != null ? endpointUri.toString() : null;
+ }
+ }
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java
index 621e6928..7b6e12aa 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2AuthorizationRequestDecoder.java
@@ -63,7 +63,7 @@ public class OAuth2AuthorizationRequestDecoder extends BaseOAuth2RequestDecoder<
.add("codeChallenge", message.getCodeChallenge())
.add("codeChallengeMethod", message.getCodeChallengeMethod())
.add("customParameters", message.getCustomParameters())
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.add("prompt", message.getPrompt())
.add("redirectionURI", message.getRedirectionURI())
.add("requestObject", message.getRequestObject() == null ?
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java
index 581d97bc..26b1b7b9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2IntrospectionRequestDecoder.java
@@ -62,7 +62,7 @@ public class OAuth2IntrospectionRequestDecoder extends BaseOAuth2RequestDecoder<
.add("customParameters", message.getCustomParameters())
.add("clientAuthentication", RequestUtil.getClientAuthenticationLog(message.getClientAuthentication()))
.add("clientAuthorization", RequestUtil.getAccessTokenLog(message.getClientAuthorization()))
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.toString();
}
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2RevocationRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2RevocationRequestDecoder.java
index 274b2089..125fbc35 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2RevocationRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/decoding/impl/OAuth2RevocationRequestDecoder.java
@@ -61,7 +61,7 @@ public class OAuth2RevocationRequestDecoder extends BaseOAuth2RequestDecoder<Tok
.add("token", message.getToken())
.add("clientId", message.getClientID())
.add("clientAuthentication", RequestUtil.getClientAuthenticationLog(message.getClientAuthentication()))
- .add("endpointURI", message.getEndpointURI())
+ .add("endpointURI", getEndpointURI(message))
.toString();
}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
index a8cc1b6e..d60687da 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/introspection/introspection-beans.xml
@@ -15,7 +15,8 @@
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
<bean class="net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.OAuth2IntrospectionRequestDecoder"
- scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
index 7f97879f..4295f8e3 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/revocation/revocation-beans.xml
@@ -15,7 +15,8 @@
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
<bean class="net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.OAuth2RevocationRequestDecoder"
- scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index a445851b..9da0b1f8 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -17,14 +17,16 @@
<bean id="DecodeOIDCMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
<bean class="net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCAuthenticationRequestDecoder"
- scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
<bean id="DecodeOAuthMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
<bean class="net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.OAuth2AuthorizationRequestDecoder"
- scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ scope="prototype" p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
index d0752eba..de7f7a33 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/register/register-beans.xml
@@ -26,7 +26,8 @@
<bean
class="net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCClientRegistrationRequestDecoder"
scope="prototype"
- p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index 6ac9f143..82807b17 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -18,7 +18,8 @@
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
<bean class="net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCTokenRequestDecoder" scope="prototype"
- p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index 61c894bf..004af880 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -18,7 +18,8 @@
<bean id="DecodeMessage" class="org.opensaml.profile.action.impl.DecodeMessage" scope="prototype">
<constructor-arg>
<bean class="net.shibboleth.idp.plugin.oidc.op.decoding.impl.OIDCUserInfoRequestDecoder" scope="prototype"
- p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest" />
+ p:httpServletRequest-ref="shibboleth.oidc.internal.HttpServletRequest"
+ p:removeIpAddressFromEndpointUri="%{idp.oidc.logging.removeIpAddressFromProtocolMessage:false}"/>
</constructor-arg>
</bean>
diff --git a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
index 20a41642..34df0fb0 100644
--- a/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
+++ b/idp-oidc-extension-impl/src/main/resources/net/shibboleth/idp/plugin/oidc/op/conf/oidc.properties
@@ -102,6 +102,9 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
# Bean used for creating SPSessions needed for SLO. By default builds protocol-independent BasicSPSession, as SLO is not yet supported.
#idp.oidc.SPSessionCreationStrategy = DefaultSPSessionCreationStrategy
+# Set to true to hide protocol-scheme, IP-address and port for endpointURI in PROTOCOL_MESSAGE.OAUTH2 logging. Defaults to false.
+#idp.oidc.logging.removeIpAddressFromProtocolMessage = true
+
# Settings for issue-registration-access-token flow
#idp.oidc.admin.registration.logging = IssueRegistrationAccessToken
#idp.oidc.admin.registration.nonBrowserSupported = true
@@ -120,7 +123,6 @@ idp.oidc.subject.salt = this_too_should_be_ch4ng3d
#idp.oidc.discovery.resolver = shibboleth.oidc.DefaultOpenIdConfigurationResolver
#idp.oidc.discovery.resolver.values = shibboleth.oidc.discovery.DefaultDynamicValueResolvers
-
#
# OAuth2 Settings - these typically involve generic OAuth 2.0 use cases
#
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list