[java-idp-oidc] branch main updated: JOIDC-224 - Openid-scope with client credentials grant may cause wrong error

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=fb9ca7dd2a3c1b13fbbe9dbff28b79b2f0ebabf8

The following commit(s) were added to refs/heads/main by this push:
     new fb9ca7dd JOIDC-224 - Openid-scope with client credentials grant may cause wrong error
fb9ca7dd is described below

commit fb9ca7dd2a3c1b13fbbe9dbff28b79b2f0ebabf8
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 17 11:48:27 2024 +0300

    JOIDC-224 - Openid-scope with client credentials grant may cause wrong error
    
    https://shibboleth.atlassian.net/browse/JOIDC-224
    
    Ignore self audience via openid -scope in the token endpoint with client_credentials grant.
---
 .../net/shibboleth/idp/flows/oidc/token/token-beans.xml     | 13 ++++++++++++-
 .../op/profile/flow/ClientCredentialsTokenFlowTest.java     |  9 +++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index eea19308..8507a891 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -173,7 +173,18 @@
 
     <bean id="ValidateAudience"
         class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateAudience" scope="prototype"
-        p:allowedAudienceLookupStrategy="#{getObject('shibboleth.oidc.AllowedAudienceStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedAudienceStrategy')}" />
+        p:allowedAudienceLookupStrategy="#{getObject('shibboleth.oidc.AllowedAudienceStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedAudienceStrategy')}">
+        <property name="selfAudienceCondition">
+            <bean parent="shibboleth.Conditions.AND">
+                <constructor-arg>
+                    <list>
+                        <ref bean="BuildOIDCTokensCondition" />
+                        <ref bean="NotClientCredentialsGrantCondition" />
+                    </list>
+                </constructor-arg>
+            </bean>
+        </property>
+    </bean>
 
     <bean id="TokenRequestScopeLookupStrategy"
         class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestScopeLookupFunction" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 058729b8..fff13395 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -124,6 +124,15 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
         assertErrorCode(result, OidcError.INVALID_TARGET_CODE);
     }
 
+    @Test
+    public void testNoAudienceWithOpenIdScope() throws ParseException, IOException {
+        setHttpFormRequest("POST", createRequestParameters(clientId, Scope.parse("openid"), null));
+        storeMetadata(storageService, clientId, clientSecret, Scope.parse("openid"), false);
+        setBasicAuth(clientId, clientSecret);
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertErrorCode(result, OidcError.INVALID_TARGET_CODE);
+    }
+
     @Test
     public void testNoScopeRegistered() throws Exception {
         setHttpFormRequest("POST", createRequestParameters(clientId, scope, resource));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.