[java-idp-oidc] branch main updated: JOIDC-197 - Allowed ResponseModes should be configurable
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Mar 15 12:26:32 UTC 2024
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-idp-oidc.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=54456ddf2358a46920806f4ec1530d0ff56296ef
The following commit(s) were added to refs/heads/main by this push:
new 54456ddf JOIDC-197 - Allowed ResponseModes should be configurable
54456ddf is described below
commit 54456ddf2358a46920806f4ec1530d0ff56296ef
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 15 14:24:34 2024 +0200
JOIDC-197 - Allowed ResponseModes should be configurable
https://shibboleth.atlassian.net/browse/JOIDC-197
Added a new action ValidateResponseMode to the authorize flow. It checks
if the requested (or default for the response type) response mode is valid
for the profile configuration. Empty/null set of valid response modes is
considered as all response modes are valid.
---
.../oauth2/profile/impl/ValidateResponseMode.java | 102 +++++++++++++++++++++
.../idp/flows/oidc/authorize/authorize-beans.xml | 3 +
.../idp/flows/oidc/authorize/authorize-flow.xml | 1 +
.../oidc/op/profile/flow/AuthorizeFlowTest.java | 98 ++++++++++++++++++++
.../shibboleth/idp/module/conf/relying-party.xml | 21 +++++
5 files changed, 225 insertions(+)
diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java
new file mode 100644
index 00000000..da0e06eb
--- /dev/null
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseMode.java
@@ -0,0 +1,102 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
+
+import java.util.Set;
+import java.util.function.Function;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.profile.action.ActionSupport;
+import org.opensaml.profile.context.ProfileRequestContext;
+import org.slf4j.Logger;
+
+import com.nimbusds.oauth2.sdk.ResponseMode;
+
+import net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.DefaultRequestResponseModeLookupFunction;
+import net.shibboleth.oidc.profile.config.navigate.ResponseModesLookupFunction;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+/**
+ * An action that validates the requested response_mode is compliant with the profile configuration.
+ */
+public class ValidateResponseMode extends AbstractOAuthAuthorizationResponseAction {
+
+ /** Class logger. */
+ @Nonnull private Logger log = LoggerFactory.getLogger(ValidateResponseMode.class);
+
+ /** Lookup strategy for fetching the requested response mode. */
+ @Nonnull private Function<ProfileRequestContext, ResponseMode> requestedResponseModeLookupStrategy;
+
+ /** Lookup strategy for fetching the valid response modes. */
+ @Nonnull private Function<ProfileRequestContext, Set<String>> validResponseModesLookupStrategy;
+
+ /**
+ * Constructor.
+ */
+ public ValidateResponseMode() {
+ requestedResponseModeLookupStrategy = new DefaultRequestResponseModeLookupFunction();
+ validResponseModesLookupStrategy = new ResponseModesLookupFunction();
+ }
+
+ /**
+ * Set the lookup strategy for fetching the requested response mode.
+ *
+ * @param strategy What to set.
+ */
+ public void setRequestedResponseModeLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, ResponseMode> strategy) {
+ checkSetterPreconditions();
+ requestedResponseModeLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /**
+ * Set the lookup strategy for fetching the valid response modes.
+ *
+ * @param strategy What to set.
+ */
+ public void setValidResponseModesLookupStrategy(
+ @Nonnull final Function<ProfileRequestContext, Set<String>> strategy) {
+ checkSetterPreconditions();
+ validResponseModesLookupStrategy = Constraint.isNotNull(strategy, "Lookup strategy cannot be null");
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext) {
+ final Set<String> validResponseModes = validResponseModesLookupStrategy.apply(profileRequestContext);
+ if (validResponseModes == null || validResponseModes.isEmpty()) {
+ log.debug("{} No restrictions for the response mode", getLogPrefix());
+ return;
+ }
+
+ final ResponseMode requestedMode = requestedResponseModeLookupStrategy.apply(profileRequestContext);
+ final ResponseMode responseMode;
+ if (requestedMode == null) {
+ responseMode = getAuthorizationRequest().impliedResponseMode();
+ log.debug("{} No response mode set in the request, using the default: {}", getLogPrefix(), responseMode);
+ } else {
+ responseMode = requestedMode;
+ log.debug("{} Using requested response mode {}", getLogPrefix(), responseMode);
+ }
+ if (!validResponseModes.stream().map(string -> new ResponseMode(string)).toList().contains(responseMode)) {
+ log.warn("{} Response mode {} is not allowed", getLogPrefix(), responseMode);
+ ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_RESPONSE_MODE);
+ }
+ }
+
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 847a9b79..7f01a35e 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -319,6 +319,9 @@
scope="prototype"
p:unregisteredClientPolicyEnforcer="#{getObject('shibboleth.oidc.UnregisteredClientPolicyEnforcer') ?: getObject('shibboleth.oidc.DefaultUnregisteredClientPolicyEnforcer')}"/>
+ <bean id="ValidateResponseMode" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateResponseMode"
+ scope="prototype" />
+
<bean id="ValidateCodeChallenge" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateCodeChallenge"
scope="prototype" />
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
index c029957a..aaee3297 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-flow.xml
@@ -66,6 +66,7 @@
<evaluate expression="ValidateRequestObject" />
<evaluate expression="ValidateRedirectURI" />
<evaluate expression="ValidateResponseType" />
+ <evaluate expression="ValidateResponseMode" />
<evaluate expression="ValidateCodeChallenge" />
<evaluate expression="SetRequestedClaimsToResponseContext" />
<evaluate expression="SetRequestedSubjectToResponseContext" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index e250c6de..26099709 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -79,6 +79,9 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
String clientId = "mockClientId";
String clientIdIssInResponse = "mockClientIdIssInResponse";
String clientIdCustomTokens = "mockClientIdCustomTokens";
+ String clientIdQueryResponseMode = "mockClientIdQueryResponseMode";
+ String clientIdFragmentResponseMode = "mockClientIdFragmentResponseMode";
+ String clientIdQueryFragmentResponseMode = "mockClientIdQueryFragmentResponseMode";
String clientSecret = "mockClientSecretmockClientSecretmockClientSecretmockClientSecretmockClientSecret";
Scope scope = Scope.parse("openid profile email");
@@ -117,6 +120,39 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
Assert.assertNull(successResponse.getIssuer());
}
+ @Test
+ public void testWithAuthorizationCodeFlow_defaultResponseModeNotAllowed() throws IOException, SessionException {
+ setRequestParameters(List.of(new Pair<>("client_id", clientIdFragmentResponseMode),
+ new Pair<>("response_type", "code"),
+ new Pair<>("scope", "openid profile"),
+ new Pair<>("redirect_uri", redirectUri)));
+ request.setMethod("GET");
+ storeMetadata(storageService, clientIdFragmentResponseMode, clientSecret, scope, redirectUri);
+
+ initializeThreadLocals();
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, "invalid_request");
+ assertErrorDescriptionContains(result, "InvalidResponseMode");
+ }
+
+ @Test
+ public void testWithAuthorizationCodeFlow_formPostResponseModeNotAllowed() throws IOException, SessionException {
+ setRequestParameters(List.of(new Pair<>("client_id", clientIdFragmentResponseMode),
+ new Pair<>("response_type", "code"),
+ new Pair<>("response_mode", "form_post"),
+ new Pair<>("scope", "openid profile"),
+ new Pair<>("redirect_uri", redirectUri)));
+ request.setMethod("GET");
+ storeMetadata(storageService, clientIdFragmentResponseMode, clientSecret, scope, redirectUri);
+
+ initializeThreadLocals();
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, "invalid_request");
+ assertErrorDescriptionContains(result, "InvalidResponseMode");
+ }
+
@Test
public void testWithAuthorizationCodeFlow_noMetadata_policyCompliant() throws IOException, SessionException {
setRequestParameters(List.of(new Pair<>("client_id", "policyAcceptedClient1"),
@@ -346,6 +382,65 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
Assert.assertNull(successResponse.getIssuer());
}
+ @Test
+ public void testWithImplicitFlow_defaultResponseModeNotAllowed() throws IOException, SessionException {
+ request.setMethod("GET");
+ setRequestParameters(List.of(new Pair<>("client_id", clientIdQueryResponseMode),
+ new Pair<>("response_type", "id_token"),
+ new Pair<>("scope", "openid profile"),
+ new Pair<>("redirect_uri", redirectUri),
+ new Pair<>("nonce", "idhas3h23hi13h1o2i32")));
+ storeMetadata(storageService, clientIdQueryResponseMode, clientSecret, scope, redirectUri);
+
+ initializeThreadLocals();
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, "invalid_request");
+ assertErrorDescriptionContains(result, "InvalidResponseMode");
+ }
+
+ @Test
+ public void testWithImplicitFlow_formPostResponseModeNotAllowed() throws IOException, SessionException {
+ request.setMethod("GET");
+ setRequestParameters(List.of(new Pair<>("client_id", clientIdQueryFragmentResponseMode),
+ new Pair<>("response_type", "id_token"),
+ new Pair<>("response_mode", "form_post"),
+ new Pair<>("scope", "openid profile"),
+ new Pair<>("redirect_uri", redirectUri),
+ new Pair<>("nonce", "idhas3h23hi13h1o2i32")));
+ storeMetadata(storageService, clientIdQueryFragmentResponseMode, clientSecret, scope, redirectUri);
+
+ initializeThreadLocals();
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ assertErrorCode(result, "invalid_request");
+ assertErrorDescriptionContains(result, "InvalidResponseMode");
+ }
+
+ @Test
+ public void testWithImplicitFlow_fragmentResponseModeAllowed() throws IOException, SessionException {
+ request.setMethod("GET");
+ setRequestParameters(List.of(new Pair<>("client_id", clientIdQueryFragmentResponseMode),
+ new Pair<>("response_type", "id_token"),
+ new Pair<>("response_mode", "fragment"),
+ new Pair<>("scope", "openid profile"),
+ new Pair<>("redirect_uri", redirectUri),
+ new Pair<>("nonce", "idhas3h23hi13h1o2i32")));
+ storeMetadata(storageService, clientIdQueryFragmentResponseMode, clientSecret, scope, redirectUri);
+
+ initializeThreadLocals();
+
+ final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+ final AuthenticationResponse responseMessage = parseSuccessResponse(result, AuthenticationResponse.class);
+ final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
+ Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
+ Assert.assertNotNull(successResponse.getIDToken());
+ Assert.assertNotNull(getSidFromIDToken(successResponse));
+ Assert.assertNull(successResponse.getAccessToken());
+ Assert.assertNull(successResponse.getAuthorizationCode());
+ Assert.assertNull(successResponse.getIssuer());
+ }
+
@Test
public void testWithImplicitFlowRequestObjectEnforcedNoRO() throws IOException, SessionException {
request.setMethod("GET");
@@ -1903,6 +1998,9 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
removeMetadata(storageService, "mockClientIdRequestObjectEnforced");
removeMetadata(storageService, clientIdIssInResponse);
removeMetadata(storageService, resourceNonUri);
+ removeMetadata(storageService, clientIdQueryResponseMode);
+ removeMetadata(storageService, clientIdQueryFragmentResponseMode);
+ removeMetadata(storageService, clientIdFragmentResponseMode);
}
}
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
index 1d96c81f..cb096e57 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
@@ -74,6 +74,27 @@
</bean>
<util:list id="shibboleth.RelyingPartyOverrides">
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdFragmentResponseMode">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO" p:responseModes="fragment" />
+ </list>
+ </property>
+ </bean>
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdQueryFragmentResponseMode">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO" p:responseModes="query,fragment" />
+ </list>
+ </property>
+ </bean>
+ <bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdQueryResponseMode">
+ <property name="profileConfigurations">
+ <list>
+ <bean parent="OIDC.SSO" p:responseModes="query" />
+ </list>
+ </property>
+ </bean>
<bean parent="RelyingPartyByName" c:relyingPartyIds="mockClientIdNotMDDriven">
<property name="profileConfigurations">
<list>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list