stable
Clone or download
When provided the nonce is added as a claim in the returned ID token [0]. To test you need to get an access token with the 'Sign scope' (if the usage of PKCE is forced, add the mandatory parameters): 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_id>&scope=openid&response_type=code&redirect_uri=<redirect_uri>&nonce=<nonce_value> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token and an ID token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. The ID token will have a 'nonce' claim set to the value you provided at the authorization request. Part of story #14714: be an OpenID Connect provider [0] https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation Change-Id: I6d38147b0518cef2fd72e8d0197151af6ef95c8d
Modified Files
| Name | ||||
|---|---|---|---|---|
| M | plugins/oauth2_server/db/install.sql | +1 | −0 | Go to diff View file |
| A | plugins/oauth2_server/db/mysql/2020/202004091420_add_oidc_nonce_column_oauth2_authorization_code.php | +46 | −0 | Go to diff View file |
| M | plugins/oauth2_server/include/AuthorizationServer/AuthorizationCodeResponseFactory.php | +4 | −2 | Go to diff View file |
| M | plugins/oauth2_server/include/AuthorizationServer/AuthorizationEndpointGetController.php | +7 | −2 | Go to diff View file |
| M | plugins/oauth2_server/include/AuthorizationServer/AuthorizationEndpointPostController.php | +3 | −1 | Go to diff View file |
| M | plugins/oauth2_server/include/AuthorizationServer/AuthorizationFormData.php | +15 | −0 | Go to diff View file |
| M | plugins/oauth2_server/include/AuthorizationServer/AuthorizationFormPresenter.php | +6 | −0 | Go to diff View file |
| M | plugins/oauth2_server/include/Grant/AuthorizationCode/OAuth2AuthorizationCode.php | +17 | −2 | Go to diff View file |
| M | plugins/oauth2_server/include/Grant/AuthorizationCode/OAuth2AuthorizationCodeCreator.php | +5 | −3 | Go to diff View file |
| M | plugins/oauth2_server/include/Grant/AuthorizationCode/OAuth2AuthorizationCodeDAO.php | +5 | −3 | Go to diff View file |
| M | plugins/oauth2_server/include/Grant/AuthorizationCode/OAuth2AuthorizationCodeVerifier.php | +1 | −1 | Go to diff View file |
| M | plugins/oauth2_server/include/OpenIDConnect/IDToken/OpenIDConnectIDTokenCreator.php | +8 | −5 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/AuthorizationServer/AuthorizationCodeResponseFactoryTest.php | +3 | −1 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/AuthorizationServer/AuthorizationFormPresenterBuilderTest.php | +2 | −0 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/AuthorizationServer/AuthorizationFormRendererTest.php | +1 | −0 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/Grant/AccessTokenGrantRepresentationBuilderTest.php | +1 | −0 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/Grant/AuthorizationCode/OAuth2AuthorizationCodeCreatorTest.php | +7 | −4 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/Grant/AuthorizationCode/OAuth2AuthorizationCodeTest.php | +3 | −0 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/Grant/AuthorizationCode/OAuth2AuthorizationCodeVerifierTest.php | +2 | −1 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/Grant/AuthorizationCode/OAuth2GrantAccessTokenFromAuthorizationCodeTest.php | +1 | −0 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/Grant/AuthorizationCode/PKCE/PKCECodeVerifierTest.php | +1 | −0 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/OpenIDConnect/IDToken/OpenIDConnectIDTokenCreatorTest.php | +14 | −4 | Go to diff View file |
| M | plugins/oauth2_server/phpunit/RefreshToken/OAuth2RefreshTokenCreatorTest.php | +1 | −0 | Go to diff View file |
| M | plugins/oauth2_server/templates/authorization-form.mustache | +1 | −0 | Go to diff View file |
| M | plugins/oauth2_server/tests/integration/AccessToken/OAuth2AccessTokenDAOTest.php | +4 | −2 | Go to diff View file |
| M | plugins/oauth2_server/tests/integration/Grant/AuthorizationCode/OAuth2AuthorizationCodeDAOTest.php | +8 | −5 | Go to diff View file |
| M | plugins/oauth2_server/tests/integration/RefreshToken/OAuth2RefreshTokenDAOTest.php | +4 | −2 | Go to diff View file |