Reject token exchange request if the requested audience is not present #37354
Conversation
|
Point 1 is already managed in PR #37353. There will be an error. Point 2 still stands and we need to decide if we manage refresh token with the restricted audience. |
There was a problem hiding this comment.
Approving, but will need rebase.
+1 to your point 2: Refresh-token should not be default requested_token_type as it is today and it might be allowed just if enabled by some switch on the client. Added some details about that in the TE docs: https://docs.google.com/document/d/16Ug7tHDq3EAZHv0PaBVe4OQ4poTDHbaXoGbkXQtO2iI/edit?tab=t.0#heading=h.o1ba6l7owxg
(Restricting for refresh-tokens and changing default requested_token_type will be follow-up issue non directly related to this PR)
Closes keycloak#37104 Signed-off-by: rmartinc <[email protected]>
a5c1d59 to
3da77be
Compare
| Assert.assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatusCode()); | ||
| Assert.assertEquals(OAuthErrorException.INVALID_CLIENT, response.getError()); | ||
| Assert.assertEquals("Audience not found", response.getErrorDescription()); | ||
| // The "target-client3" is valid client, but unavailable to the user. Request allowed, but "target-client3" audience will not be available |
There was a problem hiding this comment.
Minor: This comment is outdated now (no need to change PR unless there are more other changes needed as this can be fixed in some follow-up)
| return ((OIDCAccessTokenMapper) mapper.getValue()).transformAccessToken(token, mapper.getKey(), session, userSession, clientSessionCtx); | ||
| } | ||
| }); | ||
| final ClientModel[] requestedAucienceClients = clientSessionCtx.getAttribute(Constants.REQUESTED_AUDIENCE_CLIENTS, ClientModel[].class); |
There was a problem hiding this comment.
Minor: Typo in the variable name (no need to change PR unless there are more other changes needed as this can be fixed in some follow-up or kept as it is)
|
@mposolda If you want I can send the changes, it's not a problem. |
Closes #37104
Draft for the moment. I'm doing the option to reject the audience because I think that all of us think that it's better. But I have two doubts with this behavior: