cxf-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From cohei...@apache.org
Subject [1/2] cxf git commit: Only issue an IdToken if the client has the correct scope (for OpenId)
Date Thu, 10 Dec 2015 16:51:10 GMT
Repository: cxf
Updated Branches:
  refs/heads/master c32ebfa59 -> 00d4e973d


Only issue an IdToken if the client has the correct scope (for OpenId)


Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/00d4e973
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/00d4e973
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/00d4e973

Branch: refs/heads/master
Commit: 00d4e973dce4a2929ec88ef348a27fdbfa959954
Parents: 59d2733
Author: Colm O hEigeartaigh <coheigea@apache.org>
Authored: Thu Dec 10 15:10:32 2015 +0000
Committer: Colm O hEigeartaigh <coheigea@apache.org>
Committed: Thu Dec 10 16:46:00 2015 +0000

----------------------------------------------------------------------
 .../apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cxf/blob/00d4e973/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
----------------------------------------------------------------------
diff --git a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
index 0a19d8e..b8ab2b2 100644
--- a/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
+++ b/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java
@@ -35,7 +35,10 @@ public class IdTokenResponseFilter extends AbstractOAuthServerJoseJwtProducer
im
     private UserInfoProvider userInfoProvider;
     @Override
     public void process(ClientAccessToken ct, ServerAccessToken st) {
-        
+        // Only add an IdToken if the client has the "openid" scope
+        if (ct.getApprovedScope() == null || !ct.getApprovedScope().contains(OidcUtils.OPENID_SCOPE))
{
+            return;
+        }
         String idToken = getProcessedIdToken(st);
         if (idToken != null) {
             ct.getParameters().put(OidcUtils.ID_TOKEN, idToken);


Mime
View raw message