[java-idp-oidc] branch main updated: JOIDC-240 - RP metadata unnecessarily requires a value for response_types

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=0064cb4a581e1db03ef52b95de295c5125e22d47

The following commit(s) were added to refs/heads/main by this push:
     new 0064cb4a JOIDC-240 - RP metadata unnecessarily requires a value for response_types
0064cb4a is described below

commit 0064cb4a581e1db03ef52b95de295c5125e22d47
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri May 2 15:13:00 2025 +0300

    JOIDC-240 - RP metadata unnecessarily requires a value for response_types
    
    https://shibboleth.atlassian.net/browse/JOIDC-240
    
    Modified 'ValidateResponseType' to default to 'code' when metadata doesn't contain a value
---
 .../oidc/op/oauth2/profile/impl/ValidateResponseType.java  | 10 ++++++++--
 .../op/oauth2/profile/impl/ValidateResponseTypeTest.java   | 14 ++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java
index 4c564501..559a65ec 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseType.java
@@ -15,6 +15,7 @@
 package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
 
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 import java.util.function.BiFunction;
 import java.util.function.Function;
@@ -36,10 +37,12 @@ import net.shibboleth.oidc.metadata.policy.impl.DefaultMetadataPolicyEnforcer;
 import net.shibboleth.oidc.profile.config.navigate.UnregisteredClientPolicyLookupFunction;
 import net.shibboleth.oidc.profile.core.OidcEventIds;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.primitive.NonnullSupplier;
 
 /**
  * An action that validates the requested response_type is (1) registered to the requesting RP (or accepted in the
@@ -146,9 +149,12 @@ public class ValidateResponseType extends AbstractOAuthAuthorizationResponseActi
         if (metadataContext != null) {
             final OIDCClientInformation clientInformation = metadataContext.getClientInformation();
             if (clientInformation != null && clientInformation.getOIDCMetadata() != null) {
+                final ResponseType defaultType = ResponseType.CODE;
+                assert defaultType != null;
                 final Set<ResponseType> registeredTypes =
-                        clientInformation.getMetadata().getResponseTypes();
-                if (registeredTypes == null || registeredTypes.isEmpty() || !registeredTypes.contains(requestedType)) {
+                        Optional.ofNullable(clientInformation.getMetadata().getResponseTypes())
+                        .orElseGet(NonnullSupplier.of(CollectionSupport.setOf(defaultType)));
+                if (registeredTypes.isEmpty() || !registeredTypes.contains(requestedType)) {
                     log.warn("{} The response type {} is not registered for this RP", getLogPrefix(), requestedType);
                     ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_RESPONSE_TYPE);
                     return;
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java
index b4103313..9a12a5c9 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/ValidateResponseTypeTest.java
@@ -37,6 +37,7 @@ import org.testng.annotations.Test;
 import com.nimbusds.oauth2.sdk.ParseException;
 import com.nimbusds.oauth2.sdk.ResponseType;
 import com.nimbusds.oauth2.sdk.id.ClientID;
+import com.nimbusds.openid.connect.sdk.AuthenticationRequest;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientInformation;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
 
@@ -82,6 +83,19 @@ public class ValidateResponseTypeTest extends BaseOIDCResponseActionTest {
         ActionTestingSupport.assertProceedEvent(event);
     }
 
+    /**
+     * Test that action accepts the requested 'code' response type when metadata doesn't specify it.
+     */
+    @Test
+    public void testSuccessWithNullMetadata() throws ComponentInitializationException, ParseException, URISyntaxException {
+        initMetadata(null);
+        setAuthenticationRequest(AuthenticationRequest.parse(
+                "response_type=code&client_id=s6BhdRkqt3&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb&scope=openid"));
+
+        final Event event = action.execute(requestCtx);
+        ActionTestingSupport.assertProceedEvent(event);
+    }
+
     /**
      * Test that action rejects the "id_token token" response type.
      */

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.