libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

KEYCLOAK-2488 Token introspection returns wrong response for invalid token

Browse source
This commit is contained in:
Stian Thorgersen 2016-10-18 20:28:14 +02:00
parent a87c08416d
commit 29538332d9
2 changed files with 31 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
services/src/main/java/org/keycloak/protocol/oidc/AccessTokenIntrospectionProvider.java
View file

@ -50,27 +50,28 @@ public class AccessTokenIntrospectionProvider implements TokenIntrospectionProvi
try { try {
boolean valid = true; boolean valid = true;
RSATokenVerifier verifier = RSATokenVerifier.create(token) AccessToken toIntrospect = null;
.realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
PublicKey publicKey = session.keys().getPublicKey(realm, verifier.getHeader().getKeyId()); try {
if (publicKey == null) { RSATokenVerifier verifier = RSATokenVerifier.create(token)
valid = false; .realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
} else {
try { PublicKey publicKey = session.keys().getPublicKey(realm, verifier.getHeader().getKeyId());
if (publicKey == null) {
valid = false;
} else {
verifier.publicKey(publicKey); verifier.publicKey(publicKey);
verifier.verify(); verifier.verify();
} catch (VerificationException e) { toIntrospect = verifier.getToken();
valid = false;
} }
} catch (VerificationException e) {
valid = false;
} }
RealmModel realm = this.session.getContext().getRealm(); RealmModel realm = this.session.getContext().getRealm();
ObjectNode tokenMetadata; ObjectNode tokenMetadata;
AccessToken toIntrospect = verifier.getToken(); if (valid && toIntrospect != null) {
if (valid) {
valid = tokenManager.isTokenValid(session, realm, toIntrospect); valid = tokenManager.isTokenValid(session, realm, toIntrospect);
} }

18
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java
View file

@ -188,6 +188,24 @@ public class TokenIntrospectionTest extends TestRealmKeycloakTest {
assertNull(rep.getSubject()); assertNull(rep.getSubject());
} }
@Test
public void testUnsupportedToken() throws Exception {
oauth.doLogin("test-user@localhost", "password");
String inactiveAccessToken = "unsupported";
String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", inactiveAccessToken);
ObjectMapper objectMapper = new ObjectMapper();
JsonNode jsonNode = objectMapper.readTree(tokenResponse);
assertFalse(jsonNode.get("active").asBoolean());
TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
assertFalse(rep.isActive());
assertNull(rep.getUserName());
assertNull(rep.getClientId());
assertNull(rep.getSubject());
}
@Test @Test
public void testIntrospectAccessToken() throws Exception { public void testIntrospectAccessToken() throws Exception {
oauth.doLogin("test-user@localhost", "password"); oauth.doLogin("test-user@localhost", "password");