Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reset the client secret when the authentication is set to none #676

Closed
wants to merge 2 commits into from
Closed

Reset the client secret when the authentication is set to none #676

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
87226ef
Reset client secret when authN is set to none
federicaagostini Dec 6, 2023
2a7ec8d
Move logic at service level
federicaagostini Dec 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions ...ain/java/it/infn/mw/iam/api/client/management/service/DefaultClientManagementService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

import static it.infn.mw.iam.api.client.util.ClientSuppliers.accountNotFound;
import static it.infn.mw.iam.api.client.util.ClientSuppliers.clientNotFound;
import static java.util.Objects.isNull;

import java.text.ParseException;
import java.time.Clock;
Expand All @@ -27,6 +28,7 @@
import javax.validation.constraints.NotBlank;

import org.mitre.oauth2.model.ClientDetailsEntity;
import org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod;
import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
import org.mitre.openid.connect.service.OIDCTokenService;
import org.springframework.beans.factory.annotation.Autowired;
Expand Down Expand Up @@ -106,13 +108,13 @@ public ListResponseDTO<RegisteredClientDTO> retrieveAllClients(Pageable pageable

@Override
public Optional<RegisteredClientDTO> retrieveClientByClientId(String clientId) {
return clientService.findClientByClientId(clientId).map(converter::registeredClientDtoFromEntity);
return clientService.findClientByClientId(clientId)
.map(converter::registeredClientDtoFromEntity);
}

@Validated(OnClientCreation.class)
@Override
public RegisteredClientDTO saveNewClient(RegisteredClientDTO client)
throws ParseException {
public RegisteredClientDTO saveNewClient(RegisteredClientDTO client) throws ParseException {

ClientDetailsEntity entity = converter.entityFromClientManagementRequest(client);
entity.setDynamicallyRegistered(false);
Expand Down Expand Up @@ -150,6 +152,14 @@ public RegisteredClientDTO updateClient(String clientId, RegisteredClientDTO cli
newClient.setAuthorities(oldClient.getAuthorities());
newClient.setDynamicallyRegistered(oldClient.isDynamicallyRegistered());

if (newClient.getTokenEndpointAuthMethod().equals(AuthMethod.NONE)) {
newClient.setTokenEndpointAuthMethod(AuthMethod.NONE);
newClient.setClientSecret(null);
} else if (!newClient.getTokenEndpointAuthMethod().equals(AuthMethod.NONE)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isnt' the condition !newClient.getTokenEndpointAuthMethod().equals(AuthMethod.NONE) useless, since we are in the else branch of that condition?

&& isNull(newClient.getClientSecret())) {
newClient.setClientSecret(defaultsService.generateClientSecret());
}

newClient = clientService.updateClient(newClient);
eventPublisher.publishEvent(new ClientUpdatedEvent(this, newClient));
return converter.registeredClientDtoFromEntity(newClient);
Expand Down Expand Up @@ -227,15 +237,16 @@ private OAuth2AccessTokenEntity createRegistrationAccessTokenForClient(
return tokenService.saveAccessToken(token);

}

@Override
public RegisteredClientDTO rotateRegistrationAccessToken(@NotBlank String clientId) {
ClientDetailsEntity client =
clientService.findClientByClientId(clientId).orElseThrow(clientNotFound(clientId));

OAuth2AccessTokenEntity rat =
Optional.ofNullable(oidcTokenService.rotateRegistrationAccessTokenForClient(client))
.orElse(createRegistrationAccessTokenForClient(client));
Optional.ofNullable(oidcTokenService.rotateRegistrationAccessTokenForClient(client))
.orElse(createRegistrationAccessTokenForClient(client));

tokenService.saveAccessToken(rat);

eventPublisher.publishEvent(new ClientRegistrationAccessTokenRotatedEvent(this, client));
Expand Down
12 changes: 10 additions & 2 deletions ...java/it/infn/mw/iam/api/client/registration/service/DefaultClientRegistrationService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
import javax.validation.constraints.NotBlank;

import org.mitre.oauth2.model.ClientDetailsEntity;
import org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod;
import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
import org.mitre.oauth2.service.SystemScopeService;
import org.mitre.openid.connect.service.OIDCTokenService;
Expand Down Expand Up @@ -383,7 +384,6 @@ public RegisteredClientDTO updateClient(String clientId, RegisteredClientDTO req

ClientDetailsEntity newClient = converter.entityFromRegistrationRequest(request);
newClient.setId(oldClient.getId());
newClient.setClientSecret(oldClient.getClientSecret());
newClient.setAccessTokenValiditySeconds(oldClient.getAccessTokenValiditySeconds());
newClient.setIdTokenValiditySeconds(oldClient.getIdTokenValiditySeconds());
newClient.setRefreshTokenValiditySeconds(oldClient.getRefreshTokenValiditySeconds());
Expand All @@ -394,6 +394,14 @@ public RegisteredClientDTO updateClient(String clientId, RegisteredClientDTO req
newClient.setCreatedAt(oldClient.getCreatedAt());
newClient.setReuseRefreshToken(oldClient.isReuseRefreshToken());

if (newClient.getTokenEndpointAuthMethod().equals(AuthMethod.NONE)) {
newClient.setTokenEndpointAuthMethod(AuthMethod.NONE);
newClient.setClientSecret(null);
} else if (!newClient.getTokenEndpointAuthMethod().equals(AuthMethod.NONE)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idem

&& isNull(newClient.getClientSecret())) {
newClient.setClientSecret(defaultsService.generateClientSecret());
}

ClientDetailsEntity savedClient = clientService.updateClient(newClient);

eventPublisher.publishEvent(new ClientUpdatedEvent(this, savedClient));
Expand Down Expand Up @@ -439,7 +447,7 @@ public RegisteredClientDTO redeemClient(@NotBlank String clientId,

final IamAccount account =
accountUtils.getAuthenticatedUserAccount(authentication).orElseThrow(noAuthUserError());

client = clientService.linkClientToAccount(client, account);

eventPublisher.publishEvent(new AccountClientOwnerAssigned(this, account, client));
Expand Down
5 changes: 5 additions & 0 deletions iam-login-service/src/main/java/it/infn/mw/iam/api/client/service/ClientConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
import it.infn.mw.iam.config.IamProperties;
import it.infn.mw.iam.config.client_registration.ClientRegistrationProperties;


@Component
public class ClientConverter {

Expand Down Expand Up @@ -173,6 +174,10 @@ public RegisteredClientDTO registeredClientDtoFromEntity(ClientDetailsEntity ent
clientDTO.setRequireAuthTime(false);
}

if (entity.getTokenEndpointAuthMethod() == AuthMethod.NONE) {
clientDTO.setClientSecret(null);
}

return clientDTO;
}

Expand Down
Loading