libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

KEYCLOAK-2488 Token introspection returns wrong response for invalid token

Browse source
This commit is contained in:
Stian Thorgersen 2016-10-18 20:28:14 +02:00
parent a87c08416d
commit 29538332d9
2 changed files with 31 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
services/src/main/java/org/keycloak/protocol/oidc/AccessTokenIntrospectionProvider.java
View file

@ -50,27 +50,28 @@ public class AccessTokenIntrospectionProvider implements TokenIntrospectionProvi
try {
boolean valid = true;
RSATokenVerifier verifier = RSATokenVerifier.create(token)
.realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
AccessToken toIntrospect = null;
PublicKey publicKey = session.keys().getPublicKey(realm, verifier.getHeader().getKeyId());
if (publicKey == null) {
valid = false;
} else {
try {
try {
RSATokenVerifier verifier = RSATokenVerifier.create(token)
.realmUrl(Urls.realmIssuer(session.getContext().getUri().getBaseUri(), realm.getName()));
PublicKey publicKey = session.keys().getPublicKey(realm, verifier.getHeader().getKeyId());
if (publicKey == null) {
valid = false;
} else {
verifier.publicKey(publicKey);
verifier.verify();
} catch (VerificationException e) {
valid = false;
toIntrospect = verifier.getToken();
}
} catch (VerificationException e) {
valid = false;
}
RealmModel realm = this.session.getContext().getRealm();
ObjectNode tokenMetadata;
AccessToken toIntrospect = verifier.getToken();
if (valid) {
if (valid && toIntrospect != null) {
valid = tokenManager.isTokenValid(session, realm, toIntrospect);
}

18
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/TokenIntrospectionTest.java
View file

@ -188,6 +188,24 @@ public class TokenIntrospectionTest extends TestRealmKeycloakTest {
assertNull(rep.getSubject());
}
@Test
public void testUnsupportedToken() throws Exception {
oauth.doLogin("test-user@localhost", "password");
String inactiveAccessToken = "unsupported";
String tokenResponse = oauth.introspectAccessTokenWithClientCredential("confidential-cli", "secret1", inactiveAccessToken);
ObjectMapper objectMapper = new ObjectMapper();
JsonNode jsonNode = objectMapper.readTree(tokenResponse);
assertFalse(jsonNode.get("active").asBoolean());
TokenMetadataRepresentation rep = objectMapper.readValue(tokenResponse, TokenMetadataRepresentation.class);
assertFalse(rep.isActive());
assertNull(rep.getUserName());
assertNull(rep.getClientId());
assertNull(rep.getSubject());
}
@Test
public void testIntrospectAccessToken() throws Exception {
oauth.doLogin("test-user@localhost", "password");