[java-idp-oidc] 01/02: JOIDC-171 - Support unregistered client policies in userinfo/token/introspection/revocation

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=a073ec8f2e00676513cca94c265622f32363b551

commit a073ec8f2e00676513cca94c265622f32363b551
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Tue Sep 5 12:56:56 2023 +0300

    JOIDC-171 - Support unregistered client policies in userinfo/token/introspection/revocation
    
    https://shibboleth.atlassian.net/browse/JOIDC-171
    
    Added client ID validation against policy to the userinfo endpoint. The validation is done if
    metadata was not resolved to the requesting RP.
---
 .../idp/flows/oidc/userinfo/userinfo-beans.xml     |  5 ++++
 .../idp/flows/oidc/userinfo/userinfo-flow.xml      |  1 +
 .../plugin/oidc/op/profile/flow/UserInfoTest.java  | 32 +++++++++++++++++++++-
 .../shibboleth/idp/module/conf/relying-party.xml   |  1 +
 4 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
index 2e9e1890..e5346a37 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-beans.xml
@@ -39,6 +39,11 @@
     <bean id="RelyingPartyCredentialResolver" class="net.shibboleth.profile.relyingparty.RelyingPartyCredentialResolver" 
         c:_0-ref="shibboleth.RelyingPartyResolverService" />
 
+    <bean id="ValidateClientIDAgainstPolicy"
+        class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateClientIDAgainstPolicy"
+        p:clientIDLookupStrategy-ref="shibboleth.ClientIDLookupStrategy"
+        scope="prototype" />
+
     <bean id="ValidateAccessToken"
         class="net.shibboleth.idp.plugin.oidc.op.userinfo.profile.impl.ValidateAccessToken" scope="prototype" />
         
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
index f488146d..64dc7fb2 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/userinfo/userinfo-flow.xml
@@ -44,6 +44,7 @@
     </subflow-state>
 
     <action-state id="OutboundContextsAndSecurityParameters">
+        <evaluate expression="ValidateClientIDAgainstPolicy" />
         <evaluate expression="ValidateAccessToken" />
         <evaluate expression="ValidateScope" />
         <evaluate expression="SetRequestedClaimsToResponseContext" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
index 277aa54a..5e8a830d 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/UserInfoTest.java
@@ -105,7 +105,37 @@ public class UserInfoTest extends AbstractOidcApiFlowTest {
         final BearerAccessToken token = buildToken(idGenerator.generateIdentifier(), subject, new Scope());
         request.addHeader("Authorization", token.toAuthorizationHeader());
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
-        assertErrorCode(result, OAuth2Error.UNAUTHORIZED_CLIENT_CODE);
+        assertErrorCode(result, OAuth2Error.ACCESS_DENIED_CODE);
+    }
+
+    @Test
+    public void testSuccesUntrustedClient_policyCompliant_onlySubject() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
+        ComponentInitializationException {
+        final BearerAccessToken token = buildToken("policyAcceptedClient1", subject, new Scope("openid"));
+        request.addHeader("Authorization", token.toAuthorizationHeader());
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+        Assert.assertEquals(response.getUserInfo().getSubject().getValue(), subject);
+        final UserInfo userInfo = response.getUserInfo();
+        Assert.assertNotNull(userInfo);
+        Assert.assertNull(userInfo.getEmailAddress());
+        Assert.assertNull(userInfo.getNickname());
+        Assert.assertNull(response.getUserInfoJWT());
+    }
+
+    @Test
+    public void testSuccesUntrustedClient_policyCompliant_profileEmailFilteredOut() throws URISyntaxException, NoSuchAlgorithmException, DataSealerException,
+        ComponentInitializationException {
+        final BearerAccessToken token = buildToken("policyAcceptedClient1", subject, new Scope("openid profile email"));
+        request.addHeader("Authorization", token.toAuthorizationHeader());
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final UserInfoSuccessResponse response = parseSuccessResponse(result, UserInfoSuccessResponse.class);
+        Assert.assertEquals(response.getUserInfo().getSubject().getValue(), subject);
+        final UserInfo userInfo = response.getUserInfo();
+        Assert.assertNotNull(userInfo);
+        Assert.assertNull(userInfo.getEmailAddress());
+        Assert.assertNull(userInfo.getNickname());
+        Assert.assertNull(response.getUserInfoJWT());
     }
 
     @Test
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
index 5ee364ce..55a74f2a 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
@@ -42,6 +42,7 @@
                 <bean parent="OIDC.SSO" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
                 <bean parent="OAUTH2.Token" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
                 <bean parent="OAUTH2.TokenAudience" p:encryptionOptional="true" /> 
+                <bean parent="OIDC.UserInfo" p:unregisteredClientPolicyLookupStrategy-ref="shibboleth.oidc.DefaultUnregisteredPolicyLookupStrategy"/>
                 <ref bean="OAUTH2.Introspection" />
                 <ref bean="OAUTH2.Revocation" />
             </list>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.