[java-idp-oidc] 02/02: JOIDC-208 - Ignore scope in token endpoint with authorization code grant

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=22635f17c8c7053ad45dc3dbd94c08cc5c685513

commit 22635f17c8c7053ad45dc3dbd94c08cc5c685513
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Aug 30 19:48:47 2024 +0300

    JOIDC-208 - Ignore scope in token endpoint with authorization code grant
    
    https://shibboleth.atlassian.net/browse/JOIDC-208
    
    As oidc-common reverted to Nimbus 10, ignoring scope with code grant is implemented in the token request decoder
---
 .../op/decoding/impl/OIDCTokenRequestDecoder.java  | 48 +++++++++++++++++++---
 .../decoding/impl/OIDCTokenRequestDecoderTest.java | 17 ++++++++
 2 files changed, 60 insertions(+), 5 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java
index 681beceb..aa5bf1e9 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoder.java
@@ -15,6 +15,10 @@
 package net.shibboleth.idp.plugin.oidc.op.decoding.impl;
 
 import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -27,7 +31,11 @@ import com.nimbusds.oauth2.sdk.TokenRequest;
 import com.nimbusds.oauth2.sdk.http.HTTPRequest;
 import com.nimbusds.oauth2.sdk.http.JakartaServletUtils;
 
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
 import net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.BaseOAuth2RequestDecoder;
+import net.shibboleth.idp.plugin.oidc.op.oauth2.decoding.impl.CustomResourceHttpServletRequestWrapper;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -43,11 +51,16 @@ public class OIDCTokenRequestDecoder extends BaseOAuth2RequestDecoder<TokenReque
     @Override
     protected TokenRequest parseMessage() throws MessageDecodingException {
         try {
-            final HTTPRequest httpReq = JakartaServletUtils.createHTTPRequest(getHttpServletRequest());
-            getProtocolMessageLogger().trace("Inbound request {}", RequestUtil.toString(httpReq));
-            if (httpReq != null) {
-                switchIntoCustomResource(httpReq);
-                return TokenRequest.parse(httpReq);
+            final HttpServletRequest httpServletRequest = getHttpServletRequest();
+            if (httpServletRequest != null) {
+                getProtocolMessageLogger().trace("Inbound request {}",
+                        RequestUtil.toString(JakartaServletUtils.createHTTPRequest(httpServletRequest)));
+                final HttpServletRequestWrapper httpServletRequestWrapper =
+                        new RemoveScopeWhenCodeGrantHttpServletRequestWrapper(httpServletRequest);
+                final HTTPRequest httpReq = JakartaServletUtils.createHTTPRequest(httpServletRequestWrapper);
+                if (httpReq != null) {
+                    return TokenRequest.parse(httpReq);
+                }
             }
             throw new MessageDecodingException("Could not create HTTPRequest object from the incoming request");
         } catch (final ParseException | IOException e) {
@@ -71,4 +84,29 @@ public class OIDCTokenRequestDecoder extends BaseOAuth2RequestDecoder<TokenReque
                 .toString();
     }
 
+    /**
+     * Custom servlet wrapper that ignores scope parameter with authorization_code grant.
+     */
+    protected class RemoveScopeWhenCodeGrantHttpServletRequestWrapper extends CustomResourceHttpServletRequestWrapper {
+
+        /**
+         * Constructor.
+         *
+         * @param httpServletRequest The wrapped HTTP servlet request
+         */
+        public RemoveScopeWhenCodeGrantHttpServletRequestWrapper(@Nonnull final HttpServletRequest httpServletRequest) {
+            super(httpServletRequest);
+        }
+
+        /** {@inheritDoc} */
+        @Override
+        public Map<String, String[]> getParameterMap() {
+            final Map<String, String[]> map = new HashMap<>(super.getParameterMap());
+            final String[] grantType = map.get("grant_type");
+            if (grantType != null && Arrays.asList(grantType).contains("authorization_code")) {
+                map.remove("scope");
+            }
+            return CollectionSupport.copyToMap(map);
+        }
+    }
 }
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
index 6e1bffe9..4b42c76a 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
@@ -134,6 +134,23 @@ public class OIDCTokenRequestDecoderTest {
         Assert.assertNull(message.getScope());
     }
 
+    @Test
+    public void testRequestDecodingScopeIsNotIgnoredWithRefreshTokenGrant() throws MessageDecodingException, IOException {
+        httpRequest.addHeader("Authorization", "Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW");
+        httpRequest.setContentType("application/x-www-form-urlencoded");
+        httpRequest.addParameter("grant_type", "refresh_token");
+        httpRequest.addParameter("refresh_token", "mockRefreshToken");
+        httpRequest.addParameter("redirect_uri", "https://client.example.org/cb");
+        httpRequest.addParameter("scope", "openid profile email");
+        decoder.decode();
+        final MessageContext messageContext = decoder.getMessageContext();
+        assert messageContext != null;
+        final TokenRequest message = (TokenRequest) messageContext.getMessage();
+        assert message != null;
+        Assert.assertEquals(message.getAuthorizationGrant().getType().getValue(), "refresh_token");
+        Assert.assertNotNull(message.getScope());
+    }
+
     @Test
     public void testRequestDecodingWithCustomAssertion()
             throws MessageDecodingException, IOException, ComponentInitializationException {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.