[java-oidc-common] branch dev/JCOMOIDC-41 updated: Improve metadata response validation

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch dev/JCOMOIDC-41
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=bbb8fa1c3c29d852aea8540f7289aa3719f59cd7

The following commit(s) were added to refs/heads/dev/JCOMOIDC-41 by this push:
     new bbb8fa1  Improve metadata response validation
bbb8fa1 is described below

commit bbb8fa1c3c29d852aea8540f7289aa3719f59cd7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Sep 12 11:16:26 2022 +0100

    Improve metadata response validation
---
 .../HTTPProviderConfigurationFetchingStrategy.java | 38 +++++++++++++++++++---
 1 file changed, 33 insertions(+), 5 deletions(-)

diff --git a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/HTTPProviderConfigurationFetchingStrategy.java b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/HTTPProviderConfigurationFetchingStrategy.java
index 3e7c4df..526999a 100644
--- a/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/HTTPProviderConfigurationFetchingStrategy.java
+++ b/oidc-common-metadata-impl/src/main/java/net/shibboleth/oidc/metadata/impl/HTTPProviderConfigurationFetchingStrategy.java
@@ -100,13 +100,14 @@ public class HTTPProviderConfigurationFetchingStrategy
      * 
      * @param strategy the strategy to set.
      */
-    public void setWellKnownLocationCompositionStrategy(@Nonnull final
+    public void setWellKnownLocationCompositionStrategy(@Nullable final
             BiFunction<Issuer, String, String> strategy) {
         ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
         ComponentSupport.ifDestroyedThrowDestroyedComponentException(this);
         
-        wellKnownLocationCompositionStrategy = 
-                Constraint.isNotNull(strategy, "Well known location composition strategy can not be null");
+        if (strategy != null) {
+            wellKnownLocationCompositionStrategy = strategy;
+        }
     }
 
     @Override
@@ -178,14 +179,41 @@ public class HTTPProviderConfigurationFetchingStrategy
             try {              
                 // this should convert the entity with the character set from the entity.
                 final String jsonDocument = EntityUtils.toString(response.getEntity());                
-                return OIDCProviderMetadata.parse(jsonDocument);
+                final OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(jsonDocument);
+                if (!metadataValid(metadata, currentRequestURI)) {                    
+                    return null;
+                }
+                return metadata;
                 
             } catch (final Exception e) {
                 // catch any of the many exceptions
                 log.error("Error parsing HTTP response stream", e);
                 return null;
             }
-            
+        }
+        
+        /**
+         * Check the Issuer in the metadata is identical to the Issuer URL used to retrieve the metadata.
+         * *Note*, this just checks the Issuer URL starts with the Issuer value from the returned metadata, 
+         * otherwise these values will never be equal. It is hard to make sense of section 4.3 OpenID Discovery 1.0. 
+         * 
+         * @param metadata the OpenID Provider metadata
+         * @param issuerURL the issuerURL used to retrieve the metadata
+         * 
+         * @return true if valid, false otherwise.
+         */
+        private final boolean metadataValid(@Nonnull final OIDCProviderMetadata metadata,
+                @Nullable final String issuerURL) {
+            if (issuerURL == null || metadata.getIssuer() == null) {
+                return false;
+            }
+            final boolean valid = issuerURL.startsWith(metadata.getIssuer().getValue());
+            if (!valid) {
+                log.warn("OIDC metadata was not valid, Issuer in metadata did not match Issuer URL. Issuer "
+                        + "was '{}', IssuerURL was '{}'",metadata.getIssuer().getValue(), issuerURL);
+                return false;
+            }
+            return true;
         }
         
         /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.