[java-idp-oidc] 25/35: JOIDC-224 - Openid-scope with client credentials grant may cause wrong error

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch dev/JOIDC-222
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=ad710e91789db493d87bfadc42cad191cbb98c88

commit ad710e91789db493d87bfadc42cad191cbb98c88
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Oct 17 11:48:27 2024 +0300

    JOIDC-224 - Openid-scope with client credentials grant may cause wrong error
    
    https://shibboleth.atlassian.net/browse/JOIDC-224
    
    Ignore self audience via openid -scope in the token endpoint with client_credentials grant.
---
 .../net/shibboleth/idp/flows/oidc/token/token-beans.xml     | 13 ++++++++++++-
 .../op/profile/flow/ClientCredentialsTokenFlowTest.java     |  9 +++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
index eea19308..8507a891 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/token/token-beans.xml
@@ -173,7 +173,18 @@
 
     <bean id="ValidateAudience"
         class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateAudience" scope="prototype"
-        p:allowedAudienceLookupStrategy="#{getObject('shibboleth.oidc.AllowedAudienceStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedAudienceStrategy')}" />
+        p:allowedAudienceLookupStrategy="#{getObject('shibboleth.oidc.AllowedAudienceStrategy') ?: getObject('shibboleth.oidc.DefaultAllowedAudienceStrategy')}">
+        <property name="selfAudienceCondition">
+            <bean parent="shibboleth.Conditions.AND">
+                <constructor-arg>
+                    <list>
+                        <ref bean="BuildOIDCTokensCondition" />
+                        <ref bean="NotClientCredentialsGrantCondition" />
+                    </list>
+                </constructor-arg>
+            </bean>
+        </property>
+    </bean>
 
     <bean id="TokenRequestScopeLookupStrategy"
         class="net.shibboleth.idp.plugin.oidc.op.messaging.context.navigate.TokenRequestScopeLookupFunction" />
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
index 058729b8..fff13395 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/ClientCredentialsTokenFlowTest.java
@@ -124,6 +124,15 @@ public class ClientCredentialsTokenFlowTest extends AbstractOidcClientAuthentica
         assertErrorCode(result, OidcError.INVALID_TARGET_CODE);
     }
 
+    @Test
+    public void testNoAudienceWithOpenIdScope() throws ParseException, IOException {
+        setHttpFormRequest("POST", createRequestParameters(clientId, Scope.parse("openid"), null));
+        storeMetadata(storageService, clientId, clientSecret, Scope.parse("openid"), false);
+        setBasicAuth(clientId, clientSecret);
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertErrorCode(result, OidcError.INVALID_TARGET_CODE);
+    }
+
     @Test
     public void testNoScopeRegistered() throws Exception {
         setHttpFormRequest("POST", createRequestParameters(clientId, scope, resource));

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.