[java-idp-oidc] 01/04: JOIDC-295 - PAR-endpoint doesn't store the verified DPoP proof thumbprint to the claims set

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch maint-4.3
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/9e0e54032c7a5650311579babb56e367fb44a8da

commit 9e0e54032c7a5650311579babb56e367fb44a8da
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Nov 4 12:13:15 2026 +0200

    JOIDC-295 - PAR-endpoint doesn't store the verified DPoP proof thumbprint to the claims set
    
    https://shibboleth.atlassian.net/browse/JOIDC-295
    
    Include the dpop_jkt claim into the redirect_uri claims set via OAuth2DPoPProofContext.getValidatedDpopProofThumbprint() if no request parameter was used
---
 ...ormOutbounPushedAuthorizationResponseMessage.java | 20 +++++++++++++++++---
 .../op/profile/flow/PushedAuthorizeFlowTest.java     | 10 ++++++----
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
index 141cbe11..c7aa5f00 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/oauth2/profile/impl/FormOutbounPushedAuthorizationResponseMessage.java
@@ -17,7 +17,9 @@ package net.shibboleth.idp.plugin.oidc.op.oauth2.profile.impl;
 import java.net.URI;
 import java.text.ParseException;
 import java.time.Duration;
+import java.util.HashMap;
 import java.util.Map;
+import java.util.Optional;
 import java.util.function.BiFunction;
 import java.util.function.Function;
 
@@ -34,6 +36,7 @@ import com.nimbusds.oauth2.sdk.PushedAuthorizationRequest;
 import com.nimbusds.oauth2.sdk.PushedAuthorizationSuccessResponse;
 
 import net.shibboleth.idp.plugin.oidc.op.messaging.context.OIDCAuthenticationResponseContext;
+import net.shibboleth.idp.plugin.oidc.op.oauth2.messaging.context.OAuth2DPoPProofContext;
 import net.shibboleth.idp.profile.IdPEventIds;
 import net.shibboleth.oidc.profile.config.navigate.PushedAuthorizationRequestUriClaimsSetManipulationStrategyLookupFunction;
 import net.shibboleth.oidc.profile.config.navigate.PushedAuthorizationRequestUriLifetimeLookupFunction;
@@ -189,9 +192,20 @@ public class FormOutbounPushedAuthorizationResponseMessage extends AbstractOAuth
         final JWT requestObject = oidcContext.getRequestObject();
         if (requestObject == null) {
             assert requestMessage != null;
-            claimsSet = requestMessage.getAuthorizationRequest().toJWTClaimsSet().getClaims();
+            claimsSet = new HashMap<>(requestMessage.getAuthorizationRequest().toJWTClaimsSet().getClaims());
         } else {
-            claimsSet = requestObject.getJWTClaimsSet().getClaims();
+            claimsSet = new HashMap<>(requestObject.getJWTClaimsSet().getClaims());
+        }
+
+        if (!claimsSet.containsKey("dpop_jkt")) {
+            final String jkt = Optional.ofNullable(profileRequestContext.getInboundMessageContext())
+                    .map(msgCtx -> msgCtx.getSubcontext(OAuth2DPoPProofContext.class))
+                    .map(proofContext -> proofContext.getValidatedDpopProofThumbprint())
+                    .orElse(null);
+            if (jkt != null) {
+                log.debug("{} Included dpop_jkt from OAuth2DPoPProofContext to the claims set", getLogPrefix());
+                claimsSet.put("dpop_jkt", jkt);
+            }
         }
 
         if (manipulationStrategy != null) {
@@ -213,4 +227,4 @@ public class FormOutbounPushedAuthorizationResponseMessage extends AbstractOAuth
         assert claimsSet != null;
         return claimsSet;
     }
-}
\ No newline at end of file
+}
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
index 9029ed49..8e616d17 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/PushedAuthorizeFlowTest.java
@@ -332,17 +332,19 @@ public class PushedAuthorizeFlowTest extends AbstractOidcClientAuthenticationFlo
 
     @SuppressWarnings("null")
     @Test
-    public void testWithValidDPoPProof() throws IOException, SessionException {
+    public void testWithValidDPoPProof() throws IOException, SessionException, JOSEException {
         storeMetadata(storageService, clientId, clientSecret, scope, "https://example.org/cb");
         setBasicAuth(clientId, clientSecret);
-        request.addHeader("DPoP", buildDPoPProof("POST", "http://localhost/idp/profile/oauth2/pushed-authorization",
-                createValidDPoPNonce(clientId)).serialize());
+        final SignedJWT proof = buildDPoPProof("POST", "http://localhost/idp/profile/oauth2/pushed-authorization",
+                createValidDPoPNonce(clientId));
+        request.addHeader("DPoP", proof.serialize());
         setHttpFormRequest("POST", createRequestParameters(clientId));
         final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
         assertSuccessResponse(result, clientId);
         final PushedAuthorizationSuccessResponse response =
                 parseSuccessResponse(result, PushedAuthorizationSuccessResponse.class);
-        verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString());
+        verifyAuthorizeEndpoint(clientId, response.getRequestURI().toString(), 
+                proof.getHeader().getJWK().computeThumbprint().toString());
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.