jcoffey-dev
39c5351739
A bearer token that isn't a JWT was accepted whenever the provider's user info endpoint answered 200 for it, which it does for any token it issued to any application. So, with no audience or scope check possible on that path, an access token another application at the same provider received for a user signed that user in here. Each OIDC directory now has opaqueTokens: reject, userinfo or introspection. introspection posts the token to the provider's RFC 7662 endpoint (introspectionUrl, or the discovery document's) with HTTP Basic client authentication (introspectionClientId and introspectionClientSecret), and signs in only an active token whose iss is the directory's issuer, whose aud includes requireAudience when set, that hasn't expired, isn't marked as an ID or refresh token and carries the required scopes. A refusal of the server's own credentials is a provider error, not a failed sign-in. Left unset, a directory uses introspection when it has an introspection endpoint and rejects opaque tokens otherwise; saving one that would introspect without a client ID and secret is refused. Directories saved before this read as userinfo, so an upgrade changes nothing until an administrator chooses. The new fields are stored at version 2 of x:Directory and of x:Bootstrap (the two objects an OIDC directory is stored in); older records read without them. The admin console gets the fields, their descriptions and an Opaque Tokens form section from the served schema, and the privacy catalog lists the client secret as a credential. The per-domain directories spec now describes the audience rule and the policy. Test: on main a directory signed in an opaque token that the user info endpoint accepted (unit test: "an opaque token signed in through the user info endpoint"). Now a new directory refuses it, one saved before the policy still takes it, and introspection signs in only an active, same-issuer, right-audience access token (unit tests with a local provider; directory suite against Keycloak, including a refresh token and a token Keycloak never issued; records stored at the old versions read back as userinfo).
151 KiB
151 KiB