[java-idp-oidc] 01/02: JOIDC-249 - Introspection endpoint does not display username for JWT access tokens

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=a2284922a007294290261456017e883778b2a514

commit a2284922a007294290261456017e883778b2a514
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Jun 18 15:13:06 2025 +0300

    JOIDC-249 - Introspection endpoint does not display username for JWT access tokens
    
    https://shibboleth.atlassian.net/browse/JOIDC-249
    
    Refactored AbstractProcessTokenAction and improved flow testing coverage
---
 .../op/oauth2/profile/impl/AbstractProcessTokenAction.java    |  5 ++---
 .../plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java  | 11 +++++++++++
 .../plugin/oidc/op/profile/flow/IntrospectionFlowTest.java    |  5 +++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractProcessTokenAction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractProcessTokenAction.java
index e3cd8ebf..36d7a890 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractProcessTokenAction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/AbstractProcessTokenAction.java
@@ -243,8 +243,7 @@ public abstract class AbstractProcessTokenAction<T> extends AbstractOIDCRequestA
                         return null;
                     }
 
-                    assert signedJWT != null;
-                    final JWTClaimsSet jwtClaimsSet = signedJWT.getJWTClaimsSet();
+                    final JWTClaimsSet jwtClaimsSet = AccessTokenClaimsSet.parse(signedJWT, dataSealer).getClaimsSet();
                     log.debug("{} Checking JWT signature", getLogPrefix());
                     final Collection<Credential> credList = new ArrayList<>();
                     final CriteriaSet criteriaSet = new CriteriaSet(new UsageCriterion(UsageType.SIGNING));
@@ -269,7 +268,7 @@ public abstract class AbstractProcessTokenAction<T> extends AbstractOIDCRequestA
                     return null;
                 }
             }
-        } catch (final ParseException e1) {
+        } catch (final DataSealerException | ParseException e) {
             
         }
 
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
index cd507a0e..a7e30354 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AbstractOidcApiFlowTest.java
@@ -140,6 +140,16 @@ public class AbstractOidcApiFlowTest extends AbstractOidcFlowTest {
     @SuppressWarnings("null")
     protected BearerAccessToken buildJWTToken(final String clientId, final String subject, final Scope scope,
             final Collection<String> audience, final PrivateKey key, final String alg) throws JOSEException {
+        final String sealed;
+        try {
+            final JWTClaimsSet claimsSetToSeal =
+                    new JWTClaimsSet.Builder().claim(TokenClaimsSet.KEY_USER_PRINCIPAL, "jdoe").build();
+            final String stringToSeal = claimsSetToSeal.toString();
+            sealed = getDataSealer().wrap(stringToSeal);
+        } catch (final DataSealerException e) {
+            Assert.fail();
+            return null;
+        }
         final AccessTokenClaimsSet claims = new AccessTokenClaimsSet.Builder()
                 .setJWTID(idGenerator)
                 .setClientID(new ClientID(clientId))
@@ -151,6 +161,7 @@ public class AbstractOidcApiFlowTest extends AbstractOidcFlowTest {
                 .setAuthenticationTime(Instant.now())
                 .setScope(scope)
                 .setAudience(audience)
+                .addCustomClaim(TokenClaimsSet.KEY_SEALED_FOR_OP, sealed)
                 .build();
         return buildJWTToken(claims, key, alg);
     }
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
index 19b56059..66c9f7fc 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/IntrospectionFlowTest.java
@@ -215,6 +215,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
             Assert.assertEquals(resp.getClientID().getValue(), clientId);
             Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
             Assert.assertNull(resp.getAudience());
+            Assert.assertEquals(resp.getUsername(), "jdoe");
         }
     }
 
@@ -357,6 +358,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
         Assert.assertEquals(resp.getClientID().getValue(), clientId);
         Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
         Assert.assertNull(resp.getAudience());
+        Assert.assertEquals(resp.getUsername(), "jdoe");
     }
 
     @Test
@@ -380,6 +382,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
         Assert.assertEquals(resp.getClientID().getValue(), clientId);
         Assert.assertEquals(resp.getScope(), Scope.parse("openid"));
         Assert.assertNull(resp.getAudience());
+        Assert.assertEquals(resp.getUsername(), "jdoe");
     }
 
     @Test
@@ -555,6 +558,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
         Assert.assertEquals(resp.getScope(), scope);
         Assert.assertNull(resp.getAudience());
         assertBearerToken(resp);
+        Assert.assertEquals(resp.getUsername(), "jdoe");
     }
 
     @Test
@@ -597,6 +601,7 @@ public class IntrospectionFlowTest extends AbstractOidcClientAuthenticationFlowT
         Assert.assertEquals(resp.getScope(), scope);
         Assert.assertEquals(resp.getAudience(),
                 List.of(new Audience("https://sp.example.org"), new Audience(clientId)));
+        Assert.assertEquals(resp.getUsername(), "jdoe");
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.