libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Merge pull request #4175 from mrezai/fix-pkce-s256-code-challenge

Browse source 
KEYCLOAK-4956: Fix incorrect PKCE S256 code challenge generation
This commit is contained in:
Bill Burke 2017-06-21 17:04:31 -04:00 committed by GitHub
commit f1132ffabe
2 changed files with 7 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java
View file

@ -560,13 +560,9 @@ public class TokenEndpoint {
// https://tools.ietf.org/html/rfc7636#section-4.6 // https://tools.ietf.org/html/rfc7636#section-4.6
private String generateS256CodeChallenge(String codeVerifier) throws Exception { private String generateS256CodeChallenge(String codeVerifier) throws Exception {
MessageDigest md = MessageDigest.getInstance("SHA-256"); MessageDigest md = MessageDigest.getInstance("SHA-256");
md.update(codeVerifier.getBytes()); md.update(codeVerifier.getBytes("ISO_8859_1"));
StringBuilder sb = new StringBuilder(); byte[] digestBytes = md.digest();
for (byte b : md.digest()) { String codeVerifierEncoded = Base64Url.encode(digestBytes);
String hex = String.format("%02x", b);
sb.append(hex);
}
String codeVerifierEncoded = Base64Url.encode(sb.toString().getBytes());
return codeVerifierEncoded; return codeVerifierEncoded;
} }

12
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OAuthProofKeyForCodeExchangeTest.java
View file

@ -444,14 +444,10 @@ public class OAuthProofKeyForCodeExchangeTest extends AbstractKeycloakTest {
private String generateS256CodeChallenge(String codeVerifier) throws Exception { private String generateS256CodeChallenge(String codeVerifier) throws Exception {
MessageDigest md = MessageDigest.getInstance("SHA-256"); MessageDigest md = MessageDigest.getInstance("SHA-256");
md.update(codeVerifier.getBytes()); md.update(codeVerifier.getBytes("ISO_8859_1"));
StringBuilder sb = new StringBuilder(); byte[] digestBytes = md.digest();
for (byte b : md.digest()) { String codeChallenge = Base64Url.encode(digestBytes);
String hex = String.format("%02x", b); return codeChallenge;
sb.append(hex);
}
String codeChallenge = Base64Url.encode(sb.toString().getBytes());
return codeChallenge;
} }
private void expectSuccessfulResponseFromTokenEndpoint(String codeId, String sessionId, String code) throws Exception { private void expectSuccessfulResponseFromTokenEndpoint(String codeId, String sessionId, String code) throws Exception {