[java-idp-oidc] 02/02: JOIDC-208 - Ignore scope in token endpoint with authorization code grant

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=cad8f9530a8f92821a9f8980b4d507bd9fd8dbb3

commit cad8f9530a8f92821a9f8980b4d507bd9fd8dbb3
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed May 22 17:23:38 2024 +0300

    JOIDC-208 - Ignore scope in token endpoint with authorization code grant
    
    https://shibboleth.atlassian.net/browse/JOIDC-208
    
    With Nimbus v11 now set in commons, changed one existing test
---
 .../op/decoding/impl/OIDCTokenRequestDecoderTest.java   | 17 +++++++++++++++++
 .../idp/plugin/oidc/op/profile/flow/TokenFlowTest.java  |  5 +++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
index 3bc9f06c..78263905 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/decoding/impl/OIDCTokenRequestDecoderTest.java
@@ -117,6 +117,23 @@ public class OIDCTokenRequestDecoderTest {
                 List.of("resource.example.org"));
     }
 
+    @Test
+    public void testRequestDecodingScopeIsIgnoredWithCodeGrant() throws MessageDecodingException, IOException {
+        httpRequest.addHeader("Authorization", "Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW");
+        httpRequest.setContentType("application/x-www-form-urlencoded");
+        httpRequest.addParameter("grant_type", "authorization_code");
+        httpRequest.addParameter("code", "SplxlOBeZQQYbYS6WxSbIA");
+        httpRequest.addParameter("redirect_uri", "https://client.example.org/cb");
+        httpRequest.addParameter("scope", "openid profile email");
+        decoder.decode();
+        final MessageContext messageContext = decoder.getMessageContext();
+        assert messageContext != null;
+        final TokenRequest message = (TokenRequest) messageContext.getMessage();
+        assert message != null;
+        Assert.assertEquals(message.getAuthorizationGrant().getType().getValue(), "authorization_code");
+        Assert.assertNull(message.getScope());
+    }
+
     @Test
     public void testRequestDecodingWithCustomAssertion()
             throws MessageDecodingException, IOException, ComponentInitializationException {
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
index f5a35370..30e790d7 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/TokenFlowTest.java
@@ -611,7 +611,7 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
     public void testValidGrantWithRequestedScope() throws Exception {
         final Map<String,String> params = createRequestParameters(redirectUri, "authorization_code",
                 buildAuthorizationCode(clientId), clientId);
-        params.put("scope", "openid profile");
+        params.put("scope", "openid profile"); //will be ignored
         initializeGrantAndRequest(clientId, params);
         storeConsent(storageService, "jdoe", clientId, "mail");
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
@@ -626,7 +626,8 @@ public class TokenFlowTest extends AbstractOidcClientAuthenticationFlowTest {
         assert scope != null;
         Assert.assertTrue(scope.contains("openid"));
         Assert.assertTrue(scope.contains("profile"));
-        Assert.assertFalse(scope.contains("email"));
+        // email remains now as it exists in the authorization code's claims set
+        Assert.assertTrue(scope.contains("email"));
     }
     
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.