diff --git a/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java b/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java index bbc5e045..2d907df4 100644 --- a/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java +++ b/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java @@ -550,9 +550,9 @@ protected String prepareLoginPage(HttpServletRequest request, AuthenticationCont String callbackurl = getCallbackUrl(authenticatorProperties, context); String state = getStateParameter(request, context, authenticatorProperties); - context.setProperty(OIDCAuthenticatorConstants.AUTHENTICATOR_NAME + STATE_PARAM_SUFFIX, state); + context.setProperty(getName() + STATE_PARAM_SUFFIX, state); String nonce = UUID.randomUUID().toString(); - context.setProperty(OIDC_FEDERATION_NONCE, nonce); + context.setProperty(getName() + OIDC_FEDERATION_NONCE, nonce); boolean isPKCEEnabled = Boolean.parseBoolean( authenticatorProperties.get(OIDCAuthenticatorConstants.IS_PKCE_ENABLED)); @@ -591,7 +591,7 @@ protected String prepareLoginPage(HttpServletRequest request, AuthenticationCont String scope = paramValueMap.get(OAuthConstants.OAuth20Params.SCOPE); scope = getScope(scope, authenticatorProperties); - context.setProperty(OIDCAuthenticatorConstants.AUTHENTICATOR_NAME + SCOPE_PARAM_SUFFIX, scope); + context.setProperty(getName() + SCOPE_PARAM_SUFFIX, scope); if (StringUtils.isNotBlank(queryString) && queryString.toLowerCase().contains("scope=") && queryString .toLowerCase().contains("redirect_uri=")) { @@ -642,7 +642,7 @@ protected String prepareLoginPage(HttpServletRequest request, AuthenticationCont loginPage = loginPage + queryString; } } - context.setProperty(OIDCAuthenticatorConstants.AUTHENTICATOR_NAME + REDIRECT_URL_SUFFIX, loginPage); + context.setProperty(getName() + REDIRECT_URL_SUFFIX, loginPage); return loginPage; } else { if (LOG.isDebugEnabled()) { @@ -668,6 +668,15 @@ protected String prepareLoginPage(HttpServletRequest request, AuthenticationCont } } + protected static void setAuthenticatorMessageToContext(ErrorMessages errorMessage, + AuthenticationContext context) { + + AuthenticatorMessage authenticatorMessage = new AuthenticatorMessage(FrameworkConstants. + AuthenticatorMessageType.ERROR, errorMessage. + getCode(), errorMessage.getMessage(), null); + context.setProperty(AUTHENTICATOR_MESSAGE, authenticatorMessage); + } + /** * This method is used to append the application side requested scopes after validating. * The application can request the scopes for federated token sharing either via adaptive scripts @@ -925,15 +934,6 @@ private String getQueryParameter(AuthenticationContext context, String queryPara return null; } - private static void setAuthenticatorMessageToContext(ErrorMessages errorMessage, - AuthenticationContext context) { - - AuthenticatorMessage authenticatorMessage = new AuthenticatorMessage(FrameworkConstants. - AuthenticatorMessageType.ERROR, errorMessage. - getCode(), errorMessage.getMessage(), null); - context.setProperty(AUTHENTICATOR_MESSAGE, authenticatorMessage); - } - private String getStateParameter(HttpServletRequest request, AuthenticationContext context, Map authenticatorProperties) { @@ -1047,12 +1047,13 @@ protected void processAuthenticationResponse(HttpServletRequest request, HttpSer LOG.debug("Retrieved the User Information:" + jwtAttributeMap); } - if (StringUtils.isNotBlank((String) context.getProperty(OIDC_FEDERATION_NONCE))) { + String nonceKey = getName() + OIDC_FEDERATION_NONCE; + if (StringUtils.isNotBlank((String) context.getProperty(nonceKey))) { String nonce = (String) jwtAttributeMap.get(NONCE); if (nonce == null) { LOG.debug("OIDC provider does not support nonce claim in id_token."); } - if (nonce != null && !nonce.equals(context.getProperty(OIDC_FEDERATION_NONCE))) { + if (nonce != null && !nonce.equals(context.getProperty(nonceKey))) { setAuthenticatorMessageToContext(ErrorMessages.NONCE_MISMATCH, context); throw new AuthenticationFailedException(ErrorMessages.NONCE_MISMATCH.getCode(), @@ -1829,26 +1830,25 @@ private static AdditionalData getAdditionalData( AuthenticationContext context, boolean isNativeSDKBasedFederationCall) { AdditionalData additionalData = new AdditionalData(); + String currentAuthenticator = StringUtils.isNotBlank(context.getCurrentAuthenticator()) ? + context.getCurrentAuthenticator() : OIDCAuthenticatorConstants.AUTHENTICATOR_NAME; if (isNativeSDKBasedFederationCall) { Map additionalAuthenticationParams = new HashMap<>(); - String nonce = (String) context.getProperty(OIDC_FEDERATION_NONCE); + String nonce = (String) context.getProperty(currentAuthenticator + OIDC_FEDERATION_NONCE); if (StringUtils.isNotBlank(nonce)) { additionalAuthenticationParams.put(NONCE, nonce); } additionalAuthenticationParams.put(OIDCAuthenticatorConstants.CLIENT_ID_PARAM, context.getAuthenticatorProperties().get(OIDCAuthenticatorConstants.CLIENT_ID)); - String scope = (String) context.getProperty(OIDCAuthenticatorConstants.AUTHENTICATOR_NAME + - SCOPE_PARAM_SUFFIX); + String scope = (String) context.getProperty(currentAuthenticator + SCOPE_PARAM_SUFFIX); additionalAuthenticationParams.put(OIDCAuthenticatorConstants.SCOPE, scope); additionalData.setAdditionalAuthenticationParams(additionalAuthenticationParams); } else { - additionalData.setRedirectUrl((String) context.getProperty(OIDCAuthenticatorConstants.AUTHENTICATOR_NAME + - REDIRECT_URL_SUFFIX)); + additionalData.setRedirectUrl((String) context.getProperty(currentAuthenticator + REDIRECT_URL_SUFFIX)); Map additionalAuthenticationParams = new HashMap<>(); - String state = (String) context.getProperty(OIDCAuthenticatorConstants.AUTHENTICATOR_NAME + - STATE_PARAM_SUFFIX); + String state = (String) context.getProperty(currentAuthenticator + STATE_PARAM_SUFFIX); additionalAuthenticationParams.put(OIDCAuthenticatorConstants.OAUTH2_PARAM_STATE, state); additionalData.setAdditionalAuthenticationParams(additionalAuthenticationParams); } diff --git a/components/org.wso2.carbon.identity.application.authenticator.oidc/src/test/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticatorTest.java b/components/org.wso2.carbon.identity.application.authenticator.oidc/src/test/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticatorTest.java index 5faf536d..fec1a4f4 100644 --- a/components/org.wso2.carbon.identity.application.authenticator.oidc/src/test/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticatorTest.java +++ b/components/org.wso2.carbon.identity.application.authenticator.oidc/src/test/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticatorTest.java @@ -629,7 +629,8 @@ public void testFailProcessAuthenticationWhenNonceMisMatch() throws Exception { when(identityProvider.getIdpProperties()).thenReturn(identityProviderProperties); whenNew(OAuthClient.class).withAnyArguments().thenReturn(mockOAuthClient); when(mockOAuthClient.accessToken(any())).thenReturn(mockOAuthJSONAccessTokenResponse); - when(mockAuthenticationContext.getProperty(OIDC_FEDERATION_NONCE)).thenReturn(invalidNonce); + String nonceKey = openIDConnectAuthenticator.getName() + OIDC_FEDERATION_NONCE; + when(mockAuthenticationContext.getProperty(nonceKey)).thenReturn(invalidNonce); when(mockOAuthJSONAccessTokenResponse.getParam(anyString())).thenReturn(idToken); Assert.assertThrows( @@ -1082,7 +1083,8 @@ public void testGetAuthInitiationDataForNativeSDKBasedFederation() { when(externalIdPConfig.getIdentityProvider()).thenReturn(identityProvider); when(identityProvider.getIdpProperties()).thenReturn(identityProviderProperties); when(mockAuthenticationContext.getAuthenticationRequest()).thenReturn(mockAuthenticationRequest); - when(mockAuthenticationContext.getProperty(OIDC_FEDERATION_NONCE)).thenReturn(nonce); + String nonceKey = openIDConnectAuthenticator.getName() + OIDC_FEDERATION_NONCE; + when(mockAuthenticationContext.getProperty(nonceKey)).thenReturn(nonce); when(mockAuthenticationContext.getAuthenticatorProperties()).thenReturn(authenticatorProperties); authenticatorProperties.put(OIDCAuthenticatorConstants.CLIENT_ID, clientId);