[java-idp-oidc] branch main updated: Exploit OidcEventIds.INVALID_SCOPE constant instead of local string.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=a146072a66dfb911c1fb89abb35780dcbeca7c92

The following commit(s) were added to refs/heads/main by this push:
     new a146072a Exploit OidcEventIds.INVALID_SCOPE constant instead of local string.
a146072a is described below

commit a146072a66dfb911c1fb89abb35780dcbeca7c92
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu May 4 14:17:13 2023 +0300

    Exploit OidcEventIds.INVALID_SCOPE constant instead of local string.
---
 .../idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java  | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
index b369f6af..108f581c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
@@ -40,6 +40,7 @@ import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequest
 import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestedScopeLookupFunction;
 import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.OIDCAuthenticationResponseContextLookupFunction;
 import net.shibboleth.idp.profile.context.navigate.RelyingPartyIdLookupFunction;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
@@ -191,8 +192,7 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
                 (allowedScopes == null || !allowedScopes.contains(oidcScope))) {
             log.warn("{} OIDC sequence was requested but no openid scope granted for RP {}", getLogPrefix(),
                     clientId);
-            //TODO: once oidc-common is updated to contain INVALID_SCOPE event, switch into that
-            ActionSupport.buildEvent(profileRequestContext, "InvalidScope");
+            ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_SCOPE);
             return;
         }
 
@@ -200,15 +200,13 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
         if (mandatoryScopes != null && !mandatoryScopes.isEmpty()) {
             if (requestedScopes == null || requestedScopes.isEmpty()) {
                 log.warn("{} Mendatory scope set to {} but none requested", getLogPrefix(), mandatoryScopes.toString());
-                //TODO: once oidc-common is updated to contain INVALID_SCOPE event, switch into that
-                ActionSupport.buildEvent(profileRequestContext, "InvalidScope");
+                ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_SCOPE);
                 return;
             }
             for (final Scope.Value value : mandatoryScopes) {
                 if (!requestedScopes.contains(value.getValue())) {
                     log.warn("{} Mandatory scope {} is not requested", getLogPrefix(), value.getValue());
-                    //TODO: once oidc-common is updated to contain INVALID_SCOPE event, switch into that
-                    ActionSupport.buildEvent(profileRequestContext, "InvalidScope");
+                    ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_SCOPE);
                     return;
                 }
             }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.