8000 Ensure consent is granted before token-exchange by cavuugroup · Pull Request #26908 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Ensure consent is granted before token-exchange #26908

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cavuugroup wants to merge 4 commits into from
Closed

Ensure consent is granted before token-exchange #26908

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e106988
check consents for scopes from subject token
cavuugroup Feb 15, 2024
0e15702
Merge branch 'main' into issue/KC/20702
cavuugroup Feb 27, 2024
65259ec
Merge branch 'main' into issue/KC/20702
cavuugroup Jun 27, 2024
458af07
Merge branch 'main' into issue/KC/20702
cavuugroup Jul 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 15 additions & 7 deletions services/src/main/java/org/keycloak/protocol/oidc/DefaultTokenExchangeProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
import org.keycloak.jose.jws.JWSInput;
import org.keycloak.jose.jws.JWSInputException;
import org.keycloak.models.ClientModel;
import org.keycloak.models.ClientScopeModel;
import org.keycloak.models.ClientSessionContext;
import org.keycloak.models.FederatedIdentityModel;
import org.keycloak.models.IdentityProviderMapperModel;
Expand Down Expand Up @@ -284,7 +285,7 @@ protected Response exchangeToIdentityProvider(UserModel targetUser, UserSessionM
}

protected Response exchangeClientToClient(UserModel targetUser, UserSessionModel targetUserSession,
AccessToken token, boolean disallowOnHolderOfTokenMismatch) {
AccessToken token, boolean disallowOnHolderOfTokenMismatch) {
String requestedTokenType = formParams.getFirst(OAuth2Constants.REQUESTED_TOKEN_TYPE);
if (requestedTokenType == null) {
requestedTokenType = OAuth2Constants.REFRESH_TOKEN_TYPE;
Expand All @@ -311,12 +312,6 @@ protected Response exchangeClientToClient(UserModel targetUser, UserSessionModel
}
}

if (targetClient.isConsentRequired()) {
event.detail(Details.REASON, "audience requires consent");
event.error(Errors.CONSENT_DENIED);
throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_CLIENT, "Client requires user consent", Response.Status.BAD_REQUEST);
}

boolean isClientTheAudience = client.equals(targetClient);

if (isClientTheAudience) {
Expand Down Expand Up @@ -365,6 +360,19 @@ protected Response exchangeClientToClient(UserModel targetUser, UserSessionModel
scope = Arrays.stream(scope.split(" ")).filter(s -> "openid".equals(s) || (targetClientScopes.contains(Profile.isFeatureEnabled(Profile.Feature.DYNAMIC_SCOPES) ? s.split(":")[0] : s))).collect(Collectors.joining(" "));
}

if (scope != null) {
// verification of existing users consents for requested scopes of target client
if (!TokenManager.verifyConsentStillAvailable(session, targetUser, targetClient, TokenManager.getRequestedClientScopes(scope, client))) {
event.error(Errors.NOT_ALLOWED);
event.detail(Details.REASON, String.format(
"Missing some consents of [%s] for audience [%s]",
TokenManager.getRequestedClientScopes(scope, client)
.map(ClientScopeModel::getName)
.collect(Collectors.joining(",")),
targetClient.getClientId()));
throw new CorsErrorResponseException(cors, OAuthErrorException.INVALID_SCOPE, "Client requires user consent", Response.Status.BAD_REQUEST);
}
}
try {
session.getContext().setClient(targetClient);
switch (requestedTokenType) {
Expand Down
0