[java-idp-oidc] branch main updated: JOIDC-119 - userinfo error response for revoked token should be invalid_token

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=034776aef62c387a71035dbb6e33411fd0f88f62

The following commit(s) were added to refs/heads/main by this push:
     new 034776ae JOIDC-119 - userinfo error response for revoked token should be invalid_token
034776ae is described below

commit 034776aef62c387a71035dbb6e33411fd0f88f62
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 2 15:51:20 2022 +0300

    JOIDC-119 - userinfo error response for revoked token should be invalid_token
    
    https://shibboleth.atlassian.net/browse/JOIDC-119
    
    Fixed the error response code and updated tests.
---
 .../plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java  | 4 ++--
 .../idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml        | 2 ++
 .../shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java   | 7 ++++---
 .../oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java     | 4 ++--
 4 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
index edc5e804..b7a6d6fa 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessToken.java
@@ -103,7 +103,7 @@ public class ValidateAccessToken extends AbstractOIDCUserInfoValidationResponseA
         if (!(tokenClaims instanceof AccessTokenClaimsSet) || tokenClaims.getClaimsSet() == null) {
             log.error("{} Claims validation failed, unable to locate access token claims set to validate",
                     getLogPrefix());
-            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
             return;
         }
 
@@ -112,7 +112,7 @@ public class ValidateAccessToken extends AbstractOIDCUserInfoValidationResponseA
             claimsValidator.validate(tokenClaims.getClaimsSet(), profileRequestContext);
         } catch (final JWTValidationException e) {
             log.warn("{} Claims validation failed, token is invalid: {}", getLogPrefix(), e.getMessage());
-            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_GRANT);
+            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_ACCESS_TOKEN);
             return;
         }
 
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
index 98b9e258..9ff55c96 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/abstract-api/oidc-abstract-api-beans.xml
@@ -42,6 +42,8 @@
             value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).INVALID_GRANT}" />
         <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_REDIRECT_URI}"
             value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).INVALID_REQUEST}" />
+        <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_ACCESS_TOKEN}"
+            value="#{T(com.nimbusds.oauth2.sdk.token.BearerTokenError).INVALID_TOKEN}" />
             
         <entry key="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).REVOCATION_FAILED}"
             value="#{T(com.nimbusds.oauth2.sdk.OAuth2Error).SERVER_ERROR}" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index ea4cd4fe..37efb494 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -40,6 +40,7 @@ import com.nimbusds.oauth2.sdk.OAuth2Error;
 import com.nimbusds.oauth2.sdk.Scope;
 import com.nimbusds.oauth2.sdk.auth.ClientAuthenticationMethod;
 import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
+import com.nimbusds.oauth2.sdk.token.BearerTokenError;
 import com.nimbusds.openid.connect.sdk.UserInfoSuccessResponse;
 import com.nimbusds.openid.connect.sdk.claims.ClaimsSet;
 import com.nimbusds.openid.connect.sdk.claims.UserInfo;
@@ -274,7 +275,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
         storeMetadata(storageService, clientId, "mockSecret", scope);
         request.addHeader("Authorization", token.toAuthorizationHeader());
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
+        assertErrorCode(result, BearerTokenError.INVALID_TOKEN.getCode());
     }
 
     @Test
@@ -287,7 +288,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
         storeMetadata(storageService, clientId, "mockSecret", scope);
         request.addHeader("Authorization", token.toAuthorizationHeader());
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
+        assertErrorCode(result, BearerTokenError.INVALID_TOKEN.getCode());
     }
 
     @Test
@@ -299,7 +300,7 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
         storeMetadata(storageService, clientId, "mockSecret", scope);
         request.addHeader("Authorization", token.toAuthorizationHeader());
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        assertErrorCode(result, OAuth2Error.INVALID_GRANT_CODE);
+        assertErrorCode(result, BearerTokenError.INVALID_TOKEN.getCode());
     }
 
 }
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java
index c613e05f..2ee902c4 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/userinfo/profile/impl/ValidateAccessTokenTest.java
@@ -117,7 +117,7 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
         respCtx.setAuthorizationGrantClaimsSet(claims);
         
         final Event event = action.execute(requestCtx);
-        ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_GRANT);
+        ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_ACCESS_TOKEN);
     }
 
     /**
@@ -146,7 +146,7 @@ public class ValidateAccessTokenTest extends BaseOIDCResponseActionTest {
         respCtx.setAuthorizationGrantClaimsSet(claims);
         
         final Event event = action.execute(requestCtx);
-        ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_GRANT);
+        ActionTestingSupport.assertEvent(event, OidcEventIds.INVALID_ACCESS_TOKEN);
     }
 
     private class ClaimsValidatorLookup implements Function<ProfileRequestContext,ClaimsValidator> {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.