[java-oidc-common] branch dev/JCOMOIDC-139 updated: Fix redirect_uri in token request

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch dev/JCOMOIDC-139
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/476d4b0dd5fb348efc744084b99e83a40a269192

The following commit(s) were added to refs/heads/dev/JCOMOIDC-139 by this push:
     new 476d4b0d Fix redirect_uri in token request
476d4b0d is described below

commit 476d4b0dd5fb348efc744084b99e83a40a269192
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Feb 17 18:34:22 2026 +0000

    Fix redirect_uri in token request
    
     - allow for a configurable strategy to obtain the redirect_uri
---
 .../encoding/impl/AuthCodeTokenRequestEncoder.java | 32 +++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
index 71c35a30..f39e8393 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/encoding/impl/AuthCodeTokenRequestEncoder.java
@@ -15,6 +15,7 @@
 package net.shibboleth.oidc.profile.encoding.impl;
 
 import java.net.URI;
+import java.util.function.Function;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -34,6 +35,8 @@ import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
 import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
 
 import net.shibboleth.oidc.authn.context.OAuth2ClientAuthenticationContext;
+import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.logic.FunctionSupport;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /** 
@@ -46,6 +49,30 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
     @Nonnull
     private final Logger log = LoggerFactory.getLogger(AuthCodeTokenRequestEncoder.class);
     
+   /** 
+    * The strategy used to look up the redirect URI to use in the token request. This will typically be the same 
+    * URI used in the authorization request, but may be overridden if necessary. If not set, no redirect URI will be 
+    * included in the token request which may result in an error on the OpenID Provider.
+    */
+    @Nonnull private Function<ProfileRequestContext, URI> redirectUriLookupStrategy;
+    
+    public AuthCodeTokenRequestEncoder() {
+        super();
+        redirectUriLookupStrategy = FunctionSupport.constant(null);
+    }
+    
+    /**
+     * Set the strategy used to look up the redirect URI to use in the token request. This will typically be the same 
+     * URI used in the authorization request, but may be overridden if necessary. If not set, no redirect URI will be 
+     * included in the token request which may result in an error on the OpenID Provider.
+     * 
+     * @param strategy The RedirectUriLookupStrategy to set.
+     */
+    public void setRedirectUriLookupStrategy(@Nonnull final Function<ProfileRequestContext, URI> strategy) {
+        redirectUriLookupStrategy = Constraint.isNotNull(strategy,
+                "RedirectUriLookupStrategy can not be null");
+    }
+    
     @Override
     @Nullable public ClassicHttpRequest doApply(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final OIDCProviderMetadata providerMetadata) {
@@ -67,9 +94,12 @@ public class AuthCodeTokenRequestEncoder extends AbstractRequestEncoderFunction
             //    return null;
             //}
             
+            final URI redirectUri = redirectUriLookupStrategy.apply(profileRequestContext);
+            
+            // TODO finish this encoder!
             // If PKCE was set in the request (is not null) use it, else set it to null
             final AuthorizationGrant codeGrant =
-                    new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(), new URI("http://redirect/"));  //TODO REDIRECT_URI
+                    new AuthorizationCodeGrant(authnResponse.getAuthorizationCode(),redirectUri);  
                            // authnRequest.getCodeVerifier() != null ? new CodeVerifier(authnRequest.getCodeVerifier()) 
                             //        : null);
             

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.