[java-idp-oidc] branch main updated: JOIDC-295 - PAR-endpoint doesn't store the verified DPoP proof thumbprint to the claims set

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/9077b4e0ae951c9986bf35b8ba142e38318ab459

The following commit(s) were added to refs/heads/main by this push:
     new 9077b4e0 JOIDC-295 - PAR-endpoint doesn't store the verified DPoP proof thumbprint to the claims set
9077b4e0 is described below

commit 9077b4e0ae951c9986bf35b8ba142e38318ab459
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Nov 4 12:13:15 2026 +0200

    JOIDC-295 - PAR-endpoint doesn't store the verified DPoP proof thumbprint to the claims set
    
    https://shibboleth.atlassian.net/browse/JOIDC-295
    
    Include the dpop_jkt claim into the redirect_uri claims set via OAuth2DPoPProofContext.getValidatedDpopProofThumbprint() if no request parameter was used
---
 .../impl/FormOutbounPushedAuthorizationResponseMessage.java  | 12 ++++++++++++
 .../plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java | 10 ++++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
index c66614a9..d787e0e5 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
@@ -20,6 +20,7 @@ import java.time.Duration;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Optional;
 import java.util.function.BiFunction;
 import java.util.function.Function;
 
@@ -37,6 +38,7 @@ import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
 import com.nimbusds.oauth2.sdk.PushedAuthorizationSuccessResponse;
 
 import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.oauth2.messaging.context.OAuth2DPoPProofContext;
 import net.shibboleth.idp.plugin.oidc.op.profile.RequestUriClaimsSetDecorator;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.oidc.profile.config.navigate.PushedAuthorizationRequestUriClaimsSetManipulationStrategyLookupFunction;
@@ -209,6 +211,16 @@ public class FormOutbounPushedAuthorizationResponseMessage extends AbstractOAuth
             claimsSet = new HashMap<>(requestObject.getJWTClaimsSet().getClaims());
         }
 
+        if (!claimsSet.containsKey("dpop_jkt")) {
+            final String jkt = Optional.ofNullable(profileRequestContext.getInboundMessageContext())
+                    .map(msgCtx -> msgCtx.getSubcontext(OAuth2DPoPProofContext.class))
+                    .map(proofContext -> proofContext.getValidatedDpopProofThumbprint())
+                    .orElse(null);
+            if (jkt != null) {
+                log.debug("{} Included dpop_jkt from OAuth2DPoPProofContext to the claims set", getLogPrefix());
+                claimsSet.put("dpop_jkt", jkt);
+            }
+        }
         for (final RequestUriClaimsSetDecorator decorator : requestUriClaimsSetDecorators) {
             decorator.accept(claimsSet, profileRequestContext);
         }
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 71e32ea9..553af396 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -332,17 +332,19 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
 
     @SuppressWarnings("null")
     @Test
-    public void testWithValidDPoPProof() throws IOException, SessionException {
+    public void testWithValidDPoPProof() throws IOException, SessionException, JOSEException {
         storeMetadata(storageService, clientId, clientSecret, scope, "https://example.org/cb");
         setBasicAuth(clientId, clientSecret);
-        request.addHeader("DPoP", buildDPoPProof("POST", "http://localhost/idp/profile/oauth2/pushed-authorization",
-                createValidDPoPNonce(clientId)).serialize());
+        final SignedJWT proof = buildDPoPProof("POST", "http://localhost/idp/profile/oauth2/pushed-authorization",
+                createValidDPoPNonce(clientId));
+        request.addHeader("DPoP", proof.serialize());
         setHttpFormRequest("POST", createRequestParameters(clientId));
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
         assertSuccessResponse(result, clientId);
         final PushedAuthorizationSuccessResponse response =
                 parseSuccessResponse(result, PushedAuthorizationSuccessResponse.class);
-        verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString());
+        verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString(), 
+                proof.getHeader().getJWK().computeThumbprint().toString());
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.