[java-idp-oidc] 01/02: JOIDC-281 - Invalid request object signature produces InvalidMessageContext event

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/4b013df2f25aedf80974a77761167c3680cc95b8

commit 4b013df2f25aedf80974a77761167c3680cc95b8
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Thu Jun 18 10:25:37 2026 +0300

    JOIDC-281 - Invalid request object signature produces InvalidMessageContext event
    
    https://shibboleth.atlassian.net/browse/JOIDC-281
    
    Use net.shibboleth.oidc.profile.core.OidcEventIds.INVALID_REQUEST_OBJECT
---
 .../pushed-authorization-beans.xml                 |  2 ++
 .../idp/flows/oidc/authorize/authorize-beans.xml   |  2 ++
 .../op/profile/flow/PushedAuthorizeFlowTest.java   | 23 ++++++++++++++++++++++
 3 files changed, 27 insertions(+)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
index 702ca83c..beb01c64 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oauth2/pushed-authorization/pushed-authorization-beans.xml
@@ -203,6 +203,8 @@
             <bean id="RequestObjectInvolved" parent="shibboleth.Conditions.Expression"
                 c:expression="#input.ensureOutboundMessageContext().ensureSubcontext(T(net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext)).getRequestObject() != null" />
         </property>
+        <property name="errorEvent"
+            value="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_REQUEST_OBJECT}"/>
     </bean>
 
     <bean id="ValidateRequestObject" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateRequestObject"
diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
index 43ed51da..9b0dfd35 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/authorize/authorize-beans.xml
@@ -365,6 +365,8 @@
                 </constructor-arg>
             </bean>
         </property>
+        <property name="errorEvent"
+            value="#{T(net.shibboleth.oidc.profile.core.OidcEventIds).INVALID_REQUEST_OBJECT}"/>
     </bean>
 
     <bean id="ValidateRequestObject" class="net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl.ValidateRequestObject"
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index f95b62af..3856f46f 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -831,6 +831,29 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
         assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
     }
 
+    @Test
+    public void testOIDCROInvalidSignature() throws IOException, NoSuchAlgorithmException, URISyntaxException,
+            DataSealerException, ComponentInitializationException, JOSEException {
+        storeMetadata(storageService, clientId, clientSecret, scope, "https://example.org/cb");
+        setBasicAuth(clientId, clientSecret);
+        final JWTClaimsSet ro = new JWTClaimsSet.Builder()
+                .claim("iss", clientId)
+                .claim("client_id", clientId)
+                .claim("aud", issuer)
+                .claim("exp", Instant.now().plusSeconds(300).toEpochMilli() / 1000)
+                .claim("redirect_uri", "https://example.org/cb")
+                .claim("response_type", "code")
+                .claim("scope", "openid profile")
+                .build();
+        final SignedJWT requestObject = createSecretJWT(ro, clientSecret + "invalid");
+        final Map<String, String> requestParams = createRequestParameters(clientId, "profile", null,
+                requestObject.serialize());
+        requestParams.put("custom1", "custom1Value");
+        setHttpFormRequest("POST", requestParams);
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        assertErrorCode(result, OAuth2Error.INVALID_REQUEST_CODE);
+    }
+
     @Test
     public void testOIDCRONotYetValid() throws IOException, NoSuchAlgorithmException, URISyntaxException,
             DataSealerException, ComponentInitializationException, JOSEException {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.