[java-oidc-common] branch main updated: JCOMOIDC-158 - Add protocol message logging support to AuthnResponseDecoders

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/1e1d11c097dc89feef7301349c88776be79256f7

The following commit(s) were added to refs/heads/main by this push:
     new 1e1d11c0 JCOMOIDC-158 - Add protocol message logging support to AuthnResponseDecoders
1e1d11c0 is described below

commit 1e1d11c097dc89feef7301349c88776be79256f7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Mar 11 17:12:29 2026 +0000

    JCOMOIDC-158 - Add protocol message logging support to
    AuthnResponseDecoders
    
     - Add fields to cover decoding the implicit and hybrid flow responses
    
    https://shibboleth.atlassian.net/browse/JCOMOIDC-158
---
 .../decoding/impl/BaseHttpOIDCRequestDecoder.java  |  5 +++
 .../impl/HTTPPostAuthnResponseDecoderTest.java     | 49 ++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/BaseHttpOIDCRequestDecoder.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/BaseHttpOIDCRequestDecoder.java
index b2493865..7f805851 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/BaseHttpOIDCRequestDecoder.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/decoding/impl/BaseHttpOIDCRequestDecoder.java
@@ -95,6 +95,11 @@ public abstract class BaseHttpOIDCRequestDecoder extends AbstractHttpServletRequ
         if (message instanceof final AuthenticationSuccessResponse response) {
             return MoreObjects.toStringHelper(this).omitNullValues()
                     .add("state", response.getState())
+                    .add("response_mode", response.getResponseMode())
+                    .add("access_token", response.getAccessToken())
+                    .add("token_type", response.getAccessToken() != null ? 
+                            response.getAccessToken().getType() : null)
+                    .add("id_token", response.getIDToken() == null ? null : response.getIDToken().serialize())
                     .add("code", response.getAuthorizationCode())
                     .toString();
         }
diff --git a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java
index a0e422c1..c513d322 100644
--- a/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java
+++ b/oidc-common-profile-impl/src/test/java/net/shibboleth/oidc/profile/decoding/impl/HTTPPostAuthnResponseDecoderTest.java
@@ -18,6 +18,11 @@ import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
 
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Date;
+import java.util.List;
+
 import org.opensaml.messaging.context.MessageContext;
 import org.opensaml.messaging.decoder.MessageDecodingException;
 import org.springframework.mock.web.MockHttpServletRequest;
@@ -25,6 +30,8 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.PlainJWT;
 import com.nimbusds.openid.connect.sdk.AuthenticationErrorResponse;
 import com.nimbusds.openid.connect.sdk.AuthenticationResponse;
 import com.nimbusds.openid.connect.sdk.AuthenticationSuccessResponse;
@@ -68,6 +75,48 @@ public class HTTPPostAuthnResponseDecoderTest {
         assertTrue(((AuthenticationSuccessResponse) msg).getAuthorizationCode().getValue().equals("XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR"));
     }
     
+    @SuppressWarnings("null")
+    @Test
+    public void testSuccessfulDecoding_Query_Implicit() throws Exception {
+        final PlainJWT idToken = new PlainJWT(new JWTClaimsSet.Builder().subject("joe")
+                .issuer("https://op.example.com")
+                .audience(List.of("https://rp.example.com"))
+                .issueTime(Date.from(Instant.now()))
+                .expirationTime(Date.from(Instant.now().plus(Duration.ofSeconds(10))))
+                .claim("given_name", "Joe")
+                .build());
+        
+        final var idTokenSerialised = idToken.serialize();
+        
+        mockRequest.setMethod("POST");
+        mockRequest.setRequestURI("/idp/profile/Authn/OIDC/RP/callback");
+        mockRequest.addParameter("state", "91c28622815dd9a92ef7c984c74c9e39.65317332");
+        mockRequest.addParameter("code", "XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR");
+        mockRequest.addParameter("id_token", idTokenSerialised);
+        mockRequest.addParameter("access_token", "access_token_value");
+        mockRequest.addParameter("token_type", "Bearer");
+        mockRequest.setContentType("application/x-www-form-urlencoded");
+        decoder.setHttpServletRequestSupplier(new ThreadLocalHttpServletRequestSupplier());
+        decoder.initialize();
+        decoder.decode();
+        
+        final MessageContext mc = decoder.getMessageContext();
+        assert mc != null;
+        
+        final Object msg = mc.getMessage();
+        assertTrue(msg instanceof AuthenticationSuccessResponse);
+        assert msg != null;
+        assertTrue(((AuthenticationResponse) msg).getState().getValue().equals("91c28622815dd9a92ef7c984c74c9e39.65317332"));
+        assertTrue(((AuthenticationSuccessResponse) msg).getAuthorizationCode().getValue().equals("XSpej7DkB2WYcF1Gzth5CCHw6Oxf3gxR"));
+        final String logMessage = decoder.serializeMessageForLogging(msg);
+        assertNotNull(logMessage);
+        assertTrue(logMessage.contains("access_token"));
+        assertTrue(logMessage.contains("code"));
+        assertTrue(logMessage.contains("token_type"));
+        assertTrue(logMessage.contains("id_token"));
+        assertTrue(logMessage.contains("state"));
+    }
+    
     @Test
     public void testErrorResponseDecoding() throws Exception {
         mockRequest.setMethod("POST");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.