From 396e2e6e24c333c121ffaa373b93c1f830a0daa6 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 5 Apr 2024 14:51:02 +0200 Subject: [PATCH] Bugfix for absent scope after consent --- .../oidc/endpoints/AuthorizationEndpoint.java | 15 +++++++-- src/main/resources/templates/consent.html | 33 ------------------- .../endpoints/AuthorizationEndpointTest.java | 3 ++ 3 files changed, 16 insertions(+), 35 deletions(-) diff --git a/src/main/java/oidc/endpoints/AuthorizationEndpoint.java b/src/main/java/oidc/endpoints/AuthorizationEndpoint.java index 516a7abd..58993714 100644 --- a/src/main/java/oidc/endpoints/AuthorizationEndpoint.java +++ b/src/main/java/oidc/endpoints/AuthorizationEndpoint.java @@ -138,6 +138,10 @@ private ModelAndView doAuthorization(MultiValueMap parameters, //Can't use authenticationRequest.getState(), because this is decoded String stateValue = new QueryString(request).getStateValue(); State state = StringUtils.hasText(stateValue) ? new State(stateValue) : null; + //The form post after consent has been asked / given contains the state + if (state == null && authenticationRequest.getState() != null) { + state = authenticationRequest.getState(); + } String redirectURI = validateRedirectionURI(authenticationRequest.getRedirectionURI(), client).getRedirectURI(); @@ -166,7 +170,7 @@ private ModelAndView doAuthorization(MultiValueMap parameters, */ if (consentRequired && apiScopeRequested && (consentFromPrompt || client.isConsentRequired()) && resourceServers.size() > 0) { LOG.info("Asking for consent for User " + user + " and scopes " + scopes); - return doConsent(parameters, client, filteredScopes, resourceServers); + return doConsent(parameters, client, filteredScopes, resourceServers, state); } } //We do not provide SSO as does EB not - up to the identity provider @@ -241,13 +245,20 @@ private void logout(HttpServletRequest request) { } } - private ModelAndView doConsent(MultiValueMap parameters, OpenIDClient client, Set scopes, List resourceServers) { + private ModelAndView doConsent(MultiValueMap parameters, + OpenIDClient client, + Set scopes, + List resourceServers, + State state) { Map body = new HashMap<>(); body.put("parameters", parameters.entrySet().stream().collect(Collectors.toMap( Map.Entry::getKey, entry -> entry.getValue().get(0) ))); body.put("client", client); + if (state != null && StringUtils.hasText(state.getValue())) { + body.put("state", state.getValue()); + } body.put("resourceServers", resourceServers.stream().filter(rs -> StringUtils.hasText(rs.getLogoUrl())).collect(toList())); body.put("scopes", resourceServers.stream() .map(OpenIDClient::getScopes) diff --git a/src/main/resources/templates/consent.html b/src/main/resources/templates/consent.html index 93594690..785fdc15 100644 --- a/src/main/resources/templates/consent.html +++ b/src/main/resources/templates/consent.html @@ -100,39 +100,6 @@

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
diff --git a/src/test/java/oidc/endpoints/AuthorizationEndpointTest.java b/src/test/java/oidc/endpoints/AuthorizationEndpointTest.java index 70281da1..cb75f6e3 100644 --- a/src/test/java/oidc/endpoints/AuthorizationEndpointTest.java +++ b/src/test/java/oidc/endpoints/AuthorizationEndpointTest.java @@ -365,12 +365,15 @@ public void consent() throws IOException { String group = matcher.group(1); formParams.put(group.substring(0, group.indexOf("\"")), group.substring(group.lastIndexOf("\"") + 1)); } + assertEquals("state", formParams.get("state")); response = given().redirects().follow(false) .when() .formParams(formParams) .post("oidc/consent"); assertEquals(302, response.getStatusCode()); + String location = response.getHeader("Location"); + assertTrue(location.contains("state=state")); String code = getCode(response); Map body = doToken(code, "playground_client", "secret", GrantType.AUTHORIZATION_CODE);