[java-idp-oidc] 03/03: JOIDC-291 - Storage service based PAR produces obsolete ERROR log on authorize endpoint

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch maint-4.3
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/c152ea2526616e81d5813b6db9f8981f6ce8445f

commit c152ea2526616e81d5813b6db9f8981f6ce8445f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Mon Sep 14 17:16:33 2026 +0300

    JOIDC-291 - Storage service based PAR produces obsolete ERROR log on authorize endpoint
    
    https://shibboleth.atlassian.net/browse/JOIDC-291
    
    Skip the default deserialization implementation if the value is prefixed for the storage service
---
 ...orizationRequestUriDeserializationFunction.java |  7 +++-
 .../oidc/op/profile/flow/AuthorizeFlowTest.java    | 48 +++++++++++++++++++++-
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultPushedAuthorizationRequestUriDeserializationFunction.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultPushedAuthorizationRequestUriDeserializationFunction.java
index 106f0a12..1bf38f1c 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultPushedAuthorizationRequestUriDeserializationFunction.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/logic/DefaultPushedAuthorizationRequestUriDeserializationFunction.java
@@ -135,7 +135,12 @@ public class DefaultPushedAuthorizationRequestUriDeserializationFunction
     public Map<String,Object> apply(@Nullable final ProfileRequestContext profileRequestContext,
             @Nullable final URI uri) {
         if (uri != null) {
-            final String sealedValue = uri.toString().replace(PAR_REQUEST_URI_PREFIX, "");
+            final String uriValue = uri.toString();
+            if (uriValue.startsWith(PAR_REQUEST_URI_STORAGE_PREFIX)) {
+                log.trace("Ignoring storage service -prefixed URI {}", uriValue);
+                return null;
+            }
+            final String sealedValue = uriValue.replace(PAR_REQUEST_URI_PREFIX, "");
             assert sealedValue != null;
             try {
                 final String unsealedValue = dataSealer.unwrap(sealedValue);
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
index d45b8819..c00b0ba0 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/flow/AuthorizeFlowTest.java
@@ -69,6 +69,7 @@ import com.nimbusds.openid.connect.sdk.claims.IDTokenClaimsSet;
 import com.nimbusds.openid.connect.sdk.rp.OIDCClientMetadata;
 
 import net.shibboleth.idp.plugin.oidc.op.profile.logic.DefaultPushedAuthorizationRequestUriSerializationFunction;
+import net.shibboleth.idp.plugin.oidc.op.profile.logic.StorageServicePushedAuthorizationRequestUriSerializationFunction;
 import net.shibboleth.idp.plugin.oidc.op.testing.EmbeddedJetty;
 import net.shibboleth.idp.plugin.oidc.op.token.support.AccessTokenClaimsSet;
 import net.shibboleth.idp.plugin.oidc.op.token.support.AuthorizeCodeClaimsSet;
@@ -406,7 +407,22 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
         }
         return parGenerator.apply(null, parameters);
     }
-    
+
+    protected URI createStorageParGeneratedRequestUri(final Map<String, Object> parameters) {
+        final StorageServicePushedAuthorizationRequestUriSerializationFunction parGenerator =
+                new StorageServicePushedAuthorizationRequestUriSerializationFunction();
+        parGenerator.setObjectMapper(new ObjectMapper());
+        parGenerator.setStorageService(storageService);
+        parGenerator.setIdentifierGeneratorLookupStrategy(prc -> idGenerator);
+        parGenerator.setId("mockPar");
+        try {
+            parGenerator.initialize();
+        } catch (ComponentInitializationException e) {
+            Assert.fail("Could not initialize PAR generator", e);
+        }
+        return parGenerator.apply(null, parameters);
+    }
+
     @Test
     public void testWithAuthorizationCodeFlow_parRequiredByMetadata() throws IOException, SessionException,
             URISyntaxException {
@@ -437,6 +453,36 @@ public class AuthorizeFlowTest extends AbstractOidcFlowTest {
         Assert.assertNull(successResponse.getIssuer());
     }
 
+    @Test
+    public void testWithAuthorizationCodeFlow_parRequiredByMetadata_storage() throws IOException, SessionException,
+            URISyntaxException {
+        setRequestParameters(List.of(new Pair<>("client_id", clientId),
+                new Pair<>("response_type", "code"),
+                new Pair<>("scope", "openid profile"),
+                new Pair<>("request_uri", createStorageParGeneratedRequestUri(Map.of(
+                        "client_id", clientId, "redirect_uri", redirectUri,
+                        "response_type", "code", "scope", "openid profile")).toString()),
+                new Pair<>("redirect_uri", redirectUri)));
+        request.setMethod("GET");
+        final OIDCClientMetadata metadata = buildMetadataSkeleton();
+        metadata.setRedirectionURIs(Set.of(new URI(redirectUri)));
+        metadata.setScope(scope);
+        metadata.requiresPushedAuthorizationRequests(true);
+        storeMetadataObject(storageService, clientId, clientSecret, metadata);
+
+        initializeThreadLocals();
+        
+        final FlowExecutionResult result = flowExecutor.launchExecution(FLOW_ID, null, externalContext);
+        final AuthenticationResponse responseMessage = parseSuccessResponse(result, AuthenticationResponse.class);
+        final AuthenticationSuccessResponse successResponse = responseMessage.toSuccessResponse();
+        Assert.assertEquals(successResponse.getRedirectionURI().toString(), redirectUri);
+        Assert.assertNull(successResponse.getIDToken());
+        Assert.assertNull(successResponse.getAccessToken());
+        Assert.assertNotNull(successResponse.getAuthorizationCode());
+        Assert.assertNotNull(getSidFromAuthorizeCodeClaimsSet(successResponse));
+        Assert.assertNull(successResponse.getIssuer());
+    }
+
     @Test
     public void testWithAuthorizationCodeFlow_parRespectedForScope() throws IOException, SessionException,
             URISyntaxException {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.