[java-idp-oidc] branch main updated: JOIDC-128 - Support OAuth authorization requests
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Oct 7 12:26:23 UTC 2022
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=2c0e325a3c88321d8691ec73a72665e3f38627a7
The following commit(s) were added to refs/heads/main by this push:
new 2c0e325a JOIDC-128 - Support OAuth authorization requests
2c0e325a is described below
commit 2c0e325a3c88321d8691ec73a72665e3f38627a7
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Oct 7 15:24:35 2022 +0300
JOIDC-128 - Support OAuth authorization requests
https://shibboleth.atlassian.net/browse/JOIDC-128
Use invalid_scope error code instead of invalid_request for scope validation errors.
As there’s not yet corresponding event identifier provided by oidc-common, “InvalidScope”
event-string is used temporarily to avoid requirement for oidc-common upgrade at this point.
I’ll make sure that next commons update contains OidcEventIds.INVALID_SCOPE constant and
use it in OP once we upgrade the dependency.
---
.../plugin/oidc/op/oauth2/profile/impl/ValidateScope.java | 10 ++++++----
.../flows/oidc/abstract-api/oidc-abstract-api-beans.xml | 2 ++
.../idp/flows/oidc/authorize/authorize-beans.xml | 2 ++
.../oidc/op/oauth2/profile/impl/ValidateScopeTest.java | 7 +++----
.../plugin/oidc/op/profile/flow/AuthorizeFlowTest.java | 15 +++++----------
.../idp/plugin/oidc/op/profile/flow/TokenFlowTest.java | 2 +-
.../idp/plugin/oidc/op/profile/flow/UserInfoTest.java | 6 +++---
7 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
index 60505d59..69a26bff 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
@@ -25,7 +25,6 @@ import javax.annotation.Nullable;
import org.opensaml.messaging.context.navigate.ChildContextLookup;
import org.opensaml.profile.action.ActionSupport;
-import org.opensaml.profile.action.EventIds;
import org.opensaml.profile.context.ProfileRequestContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -191,7 +190,8 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
(allowedScopes == null || !allowedScopes.contains(oidcScope))) {
log.warn("{} OIDC sequence was requested but no openid scope granted for RP {}", getLogPrefix(),
clientId);
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ //TODO: once oidc-common is updated to contain INVALID_SCOPE event, switch into that
+ ActionSupport.buildEvent(profileRequestContext, "InvalidScope");
return;
}
@@ -199,13 +199,15 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
if (mandatoryScopes != null && !mandatoryScopes.isEmpty()) {
if (requestedScopes == null || requestedScopes.isEmpty()) {
log.warn("{} Mendatory scope set to {} but none requested", getLogPrefix(), mandatoryScopes.toString());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ //TODO: once oidc-common is updated to contain INVALID_SCOPE event, switch into that
+ ActionSupport.buildEvent(profileRequestContext, "InvalidScope");
return;
}
for (final Scope.Value value : mandatoryScopes) {
if (!requestedScopes.contains(value.getValue())) {
log.warn("{} Mandatory scope {} is not requested", getLogPrefix(), value.getValue());
- ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+ //TODO: once oidc-common is updated to contain INVALID_SCOPE event, switch into that
+ ActionSupport.buildEvent(profileRequestContext, "InvalidScope");
return;
}
}
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
index 9ff55c96..d2a6b89d 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
@@ -47,6 +47,8 @@
<entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).REVOCATION_FAILED}"
value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).SERVER_ERROR}" />
+ <entry key="#{'InvalidScope'}"
+ value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).INVALID_SCOPE}" />
<!-- Missing from Nimbus. -->
<entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_TARGET}"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 9c2ca708..960c7cb6 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -609,6 +609,8 @@
value="#{T(net.shibboleth.oidc.profile.core.OidcError).MISSING_PKCE_CODE_CHALLENGE}" />
<entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_PKCE_TRANSFORMATION_METHOD}"
value="#{T(net.shibboleth.oidc.profile.core.OidcError).INVALID_PKCE_TRANSFORMATION_METHOD}" />
+ <entry key="#{'InvalidScope'}"
+ value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).INVALID_SCOPE}" />
</map>
</property>
</bean>
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
index 392e8041..3914b0f5 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
@@ -29,7 +29,6 @@ import net.shibboleth.idp.profile.testing.ActionTestingSupport;
import net.shibboleth.oidc.metadata.context.OIDCMetadataContext;
import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
-import org.opensaml.profile.action.EventIds;
import org.springframework.webflow.execution.Event;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
@@ -119,7 +118,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
public void testAuthnNoScopes() throws ComponentInitializationException {
metaData.setScope(null);
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, EventIds.INVALID_MESSAGE);
+ ActionTestingSupport.assertEvent(event, "InvalidScope");
Assert.assertNull(respCtx.getScope());
}
@@ -330,7 +329,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, "InvalidMessage");
+ ActionTestingSupport.assertEvent(event, "InvalidScope");
}
/**
@@ -367,7 +366,7 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
respCtx.setAuthorizationGrantClaimsSet(claims);
final Event event = action.execute(requestCtx);
- ActionTestingSupport.assertEvent(event, "InvalidMessage");
+ ActionTestingSupport.assertEvent(event, "InvalidScope");
}
}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index 8f515527..ed53235b 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -433,8 +433,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
initializeThreadLocals();
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
- assertErrorDescriptionContains(result, "InvalidMessage");
+ assertErrorCode(result, "invalid_scope");
assertErrorResponseWithNoIssuer(result);
}
@@ -606,8 +605,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
initializeThreadLocals();
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
- assertErrorDescriptionContains(result, "InvalidMessage");
+ assertErrorCode(result, "invalid_scope");
assertErrorResponseWithNoIssuer(result);
}
@@ -704,8 +702,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
initializeThreadLocals();
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
- assertErrorDescriptionContains(result, "InvalidMessage");
+ assertErrorCode(result, "invalid_scope");
assertErrorResponseWithNoIssuer(result);
}
@@ -948,8 +945,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
initializeThreadLocals();
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
- assertErrorDescriptionContains(result, "InvalidMessage");
+ assertErrorCode(result, "invalid_scope");
assertErrorResponseWithNoIssuer(result);
}
@@ -965,8 +961,7 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
initializeThreadLocals();
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
- assertErrorDescriptionContains(result, "InvalidMessage");
+ assertErrorCode(result, "invalid_scope");
assertErrorResponseWithIssuer(result);
}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index b92ab2b1..1ff133bf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -158,7 +158,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
setBasicAuth(clientId, clientSecret);
storeConsent(storageService, "jdoe", clientId, "mail");
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, "invalid_request");
+ assertErrorCode(result, "invalid_scope");
}
@Test
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index 26718392..3662722c 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -132,7 +132,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
storeMetadata(storageService, clientId, "mockSecret", scope);
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
+ assertErrorCode(result, OAuth2Error.INVALID_SCOPE_CODE);
}
@Test
@@ -142,7 +142,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
storeMetadata(storageService, clientId, "mockSecret", new Scope("profile"));
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
+ assertErrorCode(result, OAuth2Error.INVALID_SCOPE_CODE);
}
@Test
@@ -152,7 +152,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
storeMetadata(storageService, clientId, "mockSecret", null);
request.addHeader("Authorization", token.toAuthorizationHeader());
final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
- assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
+ assertErrorCode(result, OAuth2Error.INVALID_SCOPE_CODE);
}
@Test
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list