[java-oidc-common] branch main updated: Only add derived client secret credential to result if it's non-null.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=d11fe8db52a52aa6cc26a1f33b8429cc7a2b3cc2

The following commit(s) were added to refs/heads/main by this push:
     new d11fe8d  Only add derived client secret credential to result if it's non-null.
d11fe8d is described below

commit d11fe8db52a52aa6cc26a1f33b8429cc7a2b3cc2
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue May 2 15:58:51 2023 +0300

    Only add derived client secret credential to result if it's non-null.
    
    The inherited deriveClientSecretCredential(..) returns may return null credential,
    for instance if we're resolving encryption credentials for an algorithm using asymmetric
    keys. The null credentials caused logging on error-level:
    
    ERROR [org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion:65] - Credential target was null
---
 .../impl/ClientInformationCredentialResolver.java  |  4 +++-
 .../ClientInformationCredentialResolverTest.java   | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
index ba86302..cecd9f1 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolver.java
@@ -149,7 +149,9 @@ public class ClientInformationCredentialResolver extends BasicJOSEObjectCredenti
                 final ClientSecretCredential secretCred = 
                         new DefaultClientSecretCredential(information.getSecret().getValue());
                 final Credential derivedCredential = deriveClientSecretCredential(secretCred, criteriaSet);
-                credentials.add(derivedCredential);
+                if (derivedCredential != null) {
+                    credentials.add(derivedCredential);
+                }
             } catch (final ResolverException e) {
                 log.warn("Unable to derive a client_secret based credential", e);
             }            
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
index 3c5a6db..5001c9a 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/credential/impl/ClientInformationCredentialResolverTest.java
@@ -106,6 +106,28 @@ public class ClientInformationCredentialResolverTest extends BaseMetadataCredent
 
     }
 
+    @Test
+    public void testSuccess_Secret_noSecretCredentialWhenAsymmetricEncryption() throws Exception {
+        ((InitializableComponent) resolver).initialize();
+        criteria = new CriteriaSet();
+
+        criteria.add(new ClientInformationCriterion(
+                OIDCClientInformation.parse(JSONObjectUtils.parse(readJsonFromFile(CLIENT_INFORMATION_SECRET)))));
+
+        criteria.add(new UsageCriterion(UsageType.ENCRYPTION));
+        criteria.add(new KeyManagmentAlgorithmCriterion("RSA1_5"));
+        criteria.add(new DataEncryptionAlgorithmCriterion("A128GCW"));
+
+        final Iterable<Credential> creds = resolver.resolve(criteria);
+
+        assertNotNull(creds);
+        final List<Credential> credsList = new ArrayList<>();
+        creds.forEach(credsList::add);
+        // No keys nor secret
+        assertEquals(credsList.size(), 0);
+
+    }
+
     @Test
     public void testSuccess_InlineJwks() throws Exception {
         ((InitializableComponent) resolver).initialize();

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.