[java-idp-oidc] branch main updated: JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=d71ab7f384c48fea29d1ce6dd925e233d22d9a10

The following commit(s) were added to refs/heads/main by this push:
     new d71ab7f3 JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
d71ab7f3 is described below

commit d71ab7f384c48fea29d1ce6dd925e233d22d9a10
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon May 13 18:36:13 2024 +0300

    JOIDC-200 - Support for OAuth2 Pushed Authorization Requests (PAR)
    
    https://shibboleth.atlassian.net/browse/JOIDC-200
    
    PushedAuthorizationRequestClientIDLookupFunction provides support for
    public clients.
---
 ...AuthorizationRequestClientIDLookupFunction.java | 48 ++++++++++++++++++++++
 .../pushed-authorization-beans.xml                 |  2 +-
 .../op/profile/flow/PushedAuthorizeFlowTest.java   | 14 +++++++
 .../shibboleth/idp/module/conf/relying-party.xml   |  1 +
 4 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/PushedAuthorizationRequestClientIDLookupFunction.java b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/PushedAuthorizationRequestClientIDLookupFunction.java
new file mode 100644
index 00000000..7202d7f4
--- /dev/null
+++ b/idp-oidc-extension-api/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/context/navigate/PushedAuthorizationRequestClientIDLookupFunction.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.plugin.oidc.op.profile.context.navigate;
+
+import javax.annotation.Nullable;
+
+import org.opensaml.messaging.context.MessageContext;
+import org.opensaml.messaging.context.navigate.ContextDataLookupFunction;
+
+import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
+import com.nimbusds.oauth2.sdk.auth.ClientAuthentication;
+import com.nimbusds.oauth2.sdk.id.ClientID;
+
+/**
+ * A function that returns client id of the PAR request. This lookup locates client id primarily from client
+ * authentication if available. If client authentication information is not available, client id is looked from
+ * client_id parameter. Null is returned if information is not available.
+ * 
+ * @since 4.2.0
+ */
+public class PushedAuthorizationRequestClientIDLookupFunction
+        implements ContextDataLookupFunction<MessageContext, ClientID> {
+
+    /** {@inheritDoc} */
+    @Nullable
+    public ClientID apply(@Nullable final MessageContext input) {
+        if (input != null && input.getMessage() instanceof PushedAuthorizationRequest parRequest) {
+            final ClientAuthentication clientAuthentication = parRequest.getClientAuthentication();
+            if (clientAuthentication != null && clientAuthentication.getClientID() != null) {
+                return clientAuthentication.getClientID();
+            }
+            return parRequest.getAuthorizationRequest().getClientID();
+        }
+        return null;
+    }
+}
\ No newline at end of file
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
index 820d4032..d9e43abd 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
@@ -25,7 +25,7 @@
     </bean>
 
     <bean id="shibboleth.ClientIDLookupStrategy"
-        class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.TokenRequestClientIDLookupFunction"
+        class="net.shibboleth.idp.plugin.oidc.op.profile.context.navigate.PushedAuthorizationRequestClientIDLookupFunction"
         scope="prototype" />
 
     <bean id="InitializeOutboundMessageContext"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 82476eb7..7bfc7ccf 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -76,6 +76,7 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
     public void tearDown() throws IOException {
         removeMetadata(storageService, clientId);
         removeMetadata(storageService, clientIdNotMDDriven);
+        removeMetadata(storageService, "mockPublicClientIdPKCEPlainUnforced");
     }
 
     @Test
@@ -230,6 +231,19 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
         verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString());
     }
 
+    @Test
+    public void testWithPublicClient() throws IOException, SessionException {
+        final String clientId = "mockPublicClientIdPKCEPlainUnforced";
+        storeMetadata(storageService, clientId, null, scope, JWSAlgorithm.RS256, ClientAuthenticationMethod.NONE,
+                "https://example.org/cb");
+        setHttpFormRequest("POST", createRequestParameters(clientId));
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertSuccessResponse(result, clientId);
+        final PushedAuthorizationSuccessResponse response =
+                parseSuccessResponse(result, PushedAuthorizationSuccessResponse.class);
+        verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString());
+    }
+    
     @Factory
     public Object[] createRequestObjectSecurityTests() {
         return new Object[] {
diff --git a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
index caf1077a..5bf9baca 100644
--- a/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
+++ b/idp-oidc-extension-impl/src/test/resources/net/shibboleth/idp/module/conf/relying-party.xml
@@ -278,6 +278,7 @@
         <bean parent="RelyingPartyByName" c:relyingPartyIds="mockPublicClientIdPKCEPlainUnforced">
             <property name="profileConfigurations">
                  <list>
+                     <bean parent="OAUTH2.PAR.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true" p:tokenEndpointAuthMethods="none"/>
                      <bean parent="OIDC.SSO.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true" p:tokenEndpointAuthMethods="none"/>
                      <bean parent="OAUTH2.Token.MDDriven" p:forcePKCE="false" p:allowPKCEPlain="true" p:tokenEndpointAuthMethods="none"/>
                  </list>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.