[java-plugin-shibd-oidc] branch main updated: Fix error event in auth_code exchange action and add flow test

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-oidc/commit/44482d95a3d97a13ccd3930a06bdf4a07b6ad2f7

The following commit(s) were added to refs/heads/main by this push:
     new 44482d9  Fix error event in auth_code exchange action and add flow test
44482d9 is described below

commit 44482d95a3d97a13ccd3930a06bdf4a07b6ad2f7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Mar 6 12:04:33 2026 +0000

    Fix error event in auth_code exchange action and add flow test
---
 .../sp/oidc/flows/OIDCTokenConsumerFlowTest.java   | 47 +++++++++++++++++++++-
 .../profile/impl/ExchangeCodeForAccessToken.java   |  3 +-
 2 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
index 04ca736..3e2cf31 100644
--- a/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
+++ b/sp-oidc-conf-impl/src/test/java/net/shibboleth/sp/oidc/flows/OIDCTokenConsumerFlowTest.java
@@ -69,6 +69,8 @@ import com.nimbusds.oauth2.sdk.AuthorizationCode;
 import com.nimbusds.oauth2.sdk.AuthorizationResponse;
 import com.nimbusds.oauth2.sdk.ErrorObject;
 import com.nimbusds.oauth2.sdk.ResponseMode;
+import com.nimbusds.oauth2.sdk.TokenErrorResponse;
+import com.nimbusds.oauth2.sdk.TokenResponse;
 import com.nimbusds.oauth2.sdk.id.State;
 import com.nimbusds.oauth2.sdk.token.AccessToken;
 import com.nimbusds.oauth2.sdk.token.BearerAccessToken;
@@ -510,6 +512,32 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
                 "JWT \"nonce\" claim has value bad-idtoken-nonce but should be bd1b5f211250c57e");
     }
     
+    @Test
+    public void testFail_ErrorFromTokenExchange() throws Exception {
+        
+        mockOIDCEndpoints(constructErrorTokenResponseSigned("invalid_request", "invalid client authentication", 400), 
+                constructJWTUserInfoResponseSigned());     
+
+        final AuthenticationSuccessResponse response = 
+                buildOIDCAuthorizationCodeResponse(TestConstants.RESPONSE_URL, ResponseMode.QUERY, TestConstants.STATE_STRING);        
+        final DDF input = buildRemotedQueryStringResponse(response);
+        
+        // Add cookies
+        input.addmember("http.headers.Cookie").unsafe_string(TestConstants.buildCookieHeader(
+                TestConstants.AUTHENTICATION_STATE, 
+                TestConstants.APPLICATION_ID,
+                TestConstants.AUTHENTICATION_NONCE,
+                TestConstants.TARGET_URL,
+                TestConstants.buildAuthenticationState(null, false, null)));
+        
+        setApplicationRequest(TestConstants.APPLICATION_ID, input);
+
+        final FlowExecutionResult result = flowExecutor.launchExecution(TestConstants.FLOW_ID, null, externalContext);
+        assertFlowExecutionResult(result, TestConstants.FLOW_ID);
+        assertFlowExecutionOutcome(result.getOutcome());
+        assertOutputMessageEvent(result, EventIds.MESSAGE_PROC_ERROR);
+    }
+    
     /**
      * Test a failure, nonce mismatch in the id_token.
      * 
@@ -670,6 +698,23 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
          return new OIDCTokenResponse((new OIDCTokens(signedIdToken, accessToken, refreshToken)));
     }
     
+    /**
+     * Construct an error OIDC token response.
+     * 
+     * @param code the error code
+     * @param description the error description
+     * @param httpCode the http code to return
+     */
+    private TokenErrorResponse constructErrorTokenResponseSigned(
+            final String code, final String description, final int httpCode) 
+                    throws JOSEException, ParseException {
+        
+        final ErrorObject error = new ErrorObject(code, description, httpCode);
+        final TokenErrorResponse errorResponse = new TokenErrorResponse(error);
+
+        return errorResponse;
+    }
+
     /**
      * Construct a successful OIDC token response with a signed and encrypted id_token.
      * 
@@ -753,7 +798,7 @@ public class OIDCTokenConsumerFlowTest extends AbstractSPFlowTest {
      * 
      * @throws IOException on error.
      */
-    private void mockOIDCEndpoints(final OIDCTokenResponse tokenResponse, 
+    private void mockOIDCEndpoints(final TokenResponse tokenResponse, 
             final UserInfoSuccessResponse userInfoResponse) throws IOException {
         
         Mockito.when(httpClient.execute(
diff --git a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExchangeCodeForAccessToken.java b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExchangeCodeForAccessToken.java
index c353322..0a09b00 100644
--- a/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExchangeCodeForAccessToken.java
+++ b/sp-oidc-impl/src/main/java/net/shibboleth/sp/oidc/profile/impl/ExchangeCodeForAccessToken.java
@@ -33,6 +33,7 @@ import com.nimbusds.openid.connect.sdk.OIDCTokenResponse;
 
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.oidc.profile.context.AccessTokenResponseContext;
+import net.shibboleth.oidc.profile.core.OidcEventIds;
 import net.shibboleth.oidc.profile.messaging.context.OIDCPeerEntityContext;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -113,7 +114,7 @@ public class ExchangeCodeForAccessToken extends AbstractHttpOAuthAction<TokenRes
               }           
           } catch (final MessageHandlerException e) {
               log.error("{} Failed to exchange authorisation code for token result",getLogPrefix(), e);
-              ActionSupport.buildEvent(profileRequestContext, AuthnEventIds.AUTHN_EXCEPTION);
+              ActionSupport.buildEvent(profileRequestContext, OidcEventIds.INVALID_TOKEN);
           }          
     }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.