Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve Exception Handling and Add Unit Tests for API based Authentication #159

Merged
merged 2 commits into from
Nov 6, 2023
Merged

Improve Exception Handling and Add Unit Tests for API based Authentication #159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
95e4f9c
Improve exception handling and add unit tests
dhaura Nov 3, 2023
616123e
Bump framework version
dhaura Nov 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions ...a/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@
import org.wso2.carbon.identity.core.util.IdentityTenantUtil;
import org.wso2.carbon.identity.core.util.IdentityUtil;
import org.wso2.carbon.identity.oauth.common.OAuthConstants;
import org.wso2.carbon.identity.oauth2.IdentityOAuth2ClientException;
import org.wso2.carbon.identity.oauth2.IdentityOAuth2Exception;
import org.wso2.carbon.idp.mgt.IdentityProviderManagementException;
import org.wso2.carbon.idp.mgt.IdentityProviderManager;
Expand Down Expand Up @@ -746,8 +747,12 @@ protected OAuthClientResponse requestAccessToken(HttpServletRequest request, Aut
String accessToken = request.getParameter(ACCESS_TOKEN_PARAM);
try {
validateJWTToken(context, idToken);
} catch (ParseException | IdentityOAuth2Exception | JOSEException e) {
throw new AuthenticationFailedException("JWT Token validation Failed.");
} catch (ParseException | IdentityOAuth2ClientException | JOSEException e) {
throw new AuthenticationFailedException(ErrorMessages.INVALID_JWT_TOKEN.getCode(),
ErrorMessages.INVALID_JWT_TOKEN.getMessage());
} catch (IdentityOAuth2Exception e) {
throw new AuthenticationFailedException(ErrorMessages.JWT_TOKEN_VALIDATION_FAILED.getCode(),
ErrorMessages.JWT_TOKEN_VALIDATION_FAILED.getMessage(), e);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems the message's alias placeholder (%s) is not getting replaced

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This error message (JWT_TOKEN_VALIDATION_FAILED) refers to the string "JWT token validation Failed." which does not contain a place holder.

}
NativeSDKBasedFederatedOAuthClientResponse nativeSDKBasedFederatedOAuthClientResponse
= new NativeSDKBasedFederatedOAuthClientResponse();
Expand Down Expand Up @@ -784,7 +789,7 @@ private void validateJWTToken(AuthenticationContext context, String idToken) thr
IdentityProvider identityProvider = getIdentityProvider(idpIdentifier, tenantDomain);

OIDCTokenValidationUtil.validateSignature(signedJWT, identityProvider);
OIDCTokenValidationUtil.validateAudience(claimsSet.getAudience(), identityProvider , tenantDomain);
OIDCTokenValidationUtil.validateAudience(claimsSet.getAudience(), identityProvider, tenantDomain);
}

/**
Expand Down Expand Up @@ -1645,7 +1650,7 @@ private boolean isTrustedTokenIssuer(AuthenticationContext context) {

IdentityProviderProperty[] identityProviderProperties = externalIdentityProvider.getIdpProperties();
for (IdentityProviderProperty identityProviderProperty: identityProviderProperties) {
if (identityProviderProperty.getName().equals(IdPManagementConstants.IS_TRUSTED_TOKEN_ISSUER)) {
if (IdPManagementConstants.IS_TRUSTED_TOKEN_ISSUER.equals(identityProviderProperty.getName())) {
return Boolean.parseBoolean(identityProviderProperty.getValue());
}
}
Expand Down
10 changes: 6 additions & 4 deletions ...java/org/wso2/carbon/identity/application/authenticator/oidc/util/OIDCErrorConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,9 @@ public enum ErrorMessages {
"Cannot find the userId from the id_token sent by the federated IDP."),
NONCE_MISMATCH("OID-60016", "The nonce claim of the ID token is not equal to the nonce value " +
"sent in the authentication request"),
INVALID_JWT_TOKEN("OID-60017", "JWT token is invalid."),
JWT_TOKEN_AUD_CLAIM_VALIDATION_FAILED("OID-60018",
"None of the audience values matched the token endpoint alias: %s."),
// Federated IdP initiated back-channel logout client errors.
LOGOUT_TOKEN_EMPTY_OR_NULL("OID-60006",
"Logout token is empty or null. Pass a valid logout token"),
Expand Down Expand Up @@ -93,10 +96,9 @@ public enum ErrorMessages {
LOGOUT_SERVER_EXCEPTION("OID-65015", "Back channel logout failed due to server error"),
JWT_TOKEN_ISS_CLAIM_VALIDATION_FAILED(
"OID-65016", "Error while validating the iss claim in the jwt token"),
JWT_TOKEN_SIGNATURE_VALIDATION_FAILED("OID-65016",
"Error while validating the JWT token signature"),
JWT_TOKEN_AUD_CLAIM_VALIDATION_FAILED("OID-65017",
"Audience claim validation failed.");
JWT_TOKEN_VALIDATION_FAILED("OID-65016", "JWT token validation Failed."),
JWT_TOKEN_SIGNATURE_VALIDATION_FAILED("OID-65017",
"Error while validating the JWT token signature");

private final String code;
private final String message;
Expand Down
10 changes: 7 additions & 3 deletions ...org/wso2/carbon/identity/application/authenticator/oidc/util/OIDCTokenValidationUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,9 @@ public static String getIssuer(JWTClaimsSet claimsSet) throws AuthenticationFail
*
* @param audienceList - list containing audience values.
* @param idp - identity provider.
* @Param tenantDomain - the tenant domain
* @param tenantDomain - the tenant domain
*
* @throws AuthenticationFailedException if none of the audience values matched the tokenEndpoint alias
*/
public static void validateAudience(List<String> audienceList, IdentityProvider idp, String tenantDomain)
throws AuthenticationFailedException {
Expand All @@ -78,8 +80,10 @@ public static void validateAudience(List<String> audienceList, IdentityProvider
}
}
if (!audienceFound) {
throw new AuthenticationFailedException ("None of the audience values matched the tokenEndpoint Alias "
+ tokenEndPointAlias);
throw new AuthenticationFailedException (
OIDCErrorConstants.ErrorMessages.JWT_TOKEN_AUD_CLAIM_VALIDATION_FAILED.getCode(),
String.format(OIDCErrorConstants.ErrorMessages.JWT_TOKEN_AUD_CLAIM_VALIDATION_FAILED.getMessage(),
tokenEndPointAlias));
}
}

Expand Down
Loading
Loading