[java-idp-oidc] branch main updated: JOIDC-176 - Scope-parameter is required in some cases with client_credentials grant

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=7ff4e96d385993bb4f9c895385c64c523c91ba4c

The following commit(s) were added to refs/heads/main by this push:
     new 7ff4e96d JOIDC-176 - Scope-parameter is required in some cases with client_credentials grant
7ff4e96d is described below

commit 7ff4e96d385993bb4f9c895385c64c523c91ba4c
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Sep 29 16:52:16 2023 +0300

    JOIDC-176 - Scope-parameter is required in some cases with client_credentials grant
    
    https://shibboleth.atlassian.net/browse/JOIDC-176
    
    Modified ValidateScope to handle the case when scopes are not requested or previously granted.
    Improved tests.
---
 .../oidc/op/oauth2/profile/impl/ValidateScope.java |  4 +++
 .../op/oauth2/profile/impl/ValidateScopeTest.java  | 27 ++++++++++++++++++
 .../flow/ClientCredentialsTokenFlowTest.java       | 32 ++++++++++++++++++++--
 3 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
index 3966dee5..b29b78c9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScope.java
@@ -211,6 +211,10 @@ public class ValidateScope extends AbstractOAuthAuthorizationResponseAction {
             log.debug("{} No allowed scope for client {}, nothing to do", getLogPrefix(), clientId);
             return;
         }
+        if (requestedScopes == null || requestedScopes.isEmpty()) {
+            log.debug("{} No requested scope for client {}, nothing to do", getLogPrefix(), clientId);
+            return;
+        }
 
         boolean reducedRequestedScopes = false;
         
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
index a4db09ff..5a098a6c 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateScopeTest.java
@@ -245,6 +245,33 @@ public class ValidateScopeTest extends BaseOIDCResponseActionTest {
        Assert.assertNull(tokenClaimsCtx);
    }
 
+   /**
+    * Test that action works when no scopes are requested or previously granted.
+    * 
+    * @throws ComponentInitializationException
+    * @throws URISyntaxException
+    */
+   @Test
+   public void testClientCredentialsGrantNoScopesRequested() throws ComponentInitializationException, URISyntaxException {
+
+       action = new ValidateScope();
+       action.setRequestedScopeLookupStrategy(new TokenRequestScopeLookupFunction());
+       action.initialize();
+       
+       final TokenRequest req = new TokenRequest(new URI("http://localhost"),
+               new ClientSecretBasic(new ClientID("s6BhdRkqt3"), new Secret("foo")),
+               new ClientCredentialsGrant());
+       setTokenRequest(req);
+       
+       final Event event = action.execute(requestCtx);
+       ActionTestingSupport.assertProceedEvent(event);
+       Assert.assertNull(respCtx.getScope());
+
+       final OIDCAuthenticationResponseTokenClaimsContext tokenClaimsCtx =
+               respCtx.getSubcontext(OIDCAuthenticationResponseTokenClaimsContext.class);
+       Assert.assertNotNull(tokenClaimsCtx);
+   }
+
   /**
    * Test that action filters out unregistered scopes on UserInfo with prior grants.
    * 
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 218c06fc..6dd89fc3 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -123,7 +123,7 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
     }
 
     @Test
-    public void testNoScope() throws Exception {
+    public void testNoScopeRegistered() throws Exception {
         setHttpFormRequest("POST", createRequestParameters(clientId, scope, resource));
         storeMetadata(storageService, clientId, clientSecret, null);
         setBasicAuth(clientId, clientSecret);
@@ -135,7 +135,35 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
         verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
                 Collections.singletonList(resource), "eduPersonScopedAffiliation");
     }
-    
+
+    @Test
+    public void testNoScopeRequestedNorRegistered() throws Exception {
+        setHttpFormRequest("POST", createRequestParameters(clientId, null, resource));
+        storeMetadata(storageService, clientId, clientSecret, null);
+        setBasicAuth(clientId, clientSecret);
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
+        Assert.assertNotNull(response.getTokens().getBearerAccessToken());
+        Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
+        Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
+        verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+                Collections.singletonList(resource), "eduPersonScopedAffiliation");
+    }
+
+    @Test
+    public void testNoScopeRequested() throws Exception {
+        setHttpFormRequest("POST", createRequestParameters(clientId, null, resource));
+        storeMetadata(storageService, clientId, clientSecret, scope);
+        setBasicAuth(clientId, clientSecret);
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final AccessTokenResponse response = parseSuccessResponse(result, AccessTokenResponse.class);
+        Assert.assertNotNull(response.getTokens().getBearerAccessToken());
+        Assert.assertEquals(response.getTokens().getBearerAccessToken().getLifetime(), 600);
+        Assert.assertNull(response.getTokens().getBearerAccessToken().getScope());
+        verifyClaims(null, response.getTokens().getBearerAccessToken(), clientId, new Scope(),
+                Collections.singletonList(resource), "eduPersonScopedAffiliation");
+    }
+
     @Test
     public void testNoScopeUnverifiedClient() throws Exception {
         final String clientId = "policyAcceptedClient1";

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.