Logging changes per Patrick

Author: Shilen Patel

lib/Controller/OAuth2AuthorizationController.php

@@ -86,16 +86,20 @@ public function __invoke(ServerRequest $request): ResponseInterface
             return $this->authorizationServer->completeAuthorizationRequest($authorizationRequest, new Response());
         } catch (Exception $e) {
             if (!($e instanceof BadRequest)) {
+                $queryParams = $request->getQueryParams();
+                $scope = $queryParams['scope'];
                 MetricLogger::getInstance()->logMetric(
                     'oidc',
                     'error',
                     [
                         'message' => $e->getMessage(),
+                        'clientId' => $queryParams['client_id'],
+                        'scopes' => ($scope === null || $scope === "") ? [] : explode(" ", $scope),
                         'oidc' => [
                                 'endpoint' => 'authorize',
                             ]
                             // authorize endpoint doesn't contain secrets so okay to log all params
-                            + $request->getQueryParams()
+                            + $queryParams
                     ]
                 );
             }

lib/Server/AuthorizationServer.php

@@ -76,16 +76,20 @@ public function validateAuthorizationRequest(ServerRequestInterface $request): O
             $resultBag = $this->requestRulesManager->check($request, $rulesToExecute);
         } catch (OidcServerException $exception) {
             $reason = sprintf("%s %s", $exception->getMessage(), $exception->getHint() ?? '');
+            $queryParams = $request->getQueryParams();
+            $scope = $queryParams['scope'];
             MetricLogger::getInstance()->logMetric(
                 'oidc',
                 'error',
                 [
                     'message' => $reason,
+                    'clientId' => $queryParams['client_id'],
+                    'scopes' => ($scope === null || $scope === "") ? [] : explode(" ", $scope),
                     'oidc' => [
                             'endpoint' => 'authorize',
                         ]
                         // authorize endpoint doesn't contain secrets so okay to log all params
-                        + $request->getQueryParams()
+                        + $queryParams
 
                 ]
             );

lib/Server/Grants/AuthCodeGrant.php

@@ -238,6 +238,7 @@ public function completeOidcAuthorizationRequest(
             'authorize',
             [
                 'authCodeId' => $authCode->getIdentifier(),
+                'sub' => $user->getIdentifier(),
                 'scopes' => $authCode->getScopes(),
                 'grantType' => $this->getIdentifier(),
                 'clientId' => $authCode->getClient()->getIdentifier()
@@ -481,6 +482,7 @@ public function respondToAccessTokenRequest(
             'token',
             [
                 'authCodeId' => $authCodePayload->auth_code_id,
+                'tokenId' => $accessToken->getIdentifier(),
                 'sub' => $authCodePayload->user_id,
                 'scopes' => $scopes,
                 'grantType' => $this->getIdentifier(),

lib/Server/Grants/ImplicitGrant.php

@@ -230,6 +230,8 @@ private function completeOidcAuthorizationRequest(AuthorizationRequest $authoriz
             'authorize',
             [
                 'idTokenClaims' => array_keys($idToken->claims()->all()),
+                'idTokenId' => $idToken->claims()->get("jti"),
+                'tokenId' => $accessToken->getIdentifier(),
                 'sub' => $idToken->claims()->get("sub"),
                 'scopes' => $finalizedScopes,
                 'grantType' => $this->getIdentifier(),

lib/Server/Grants/RefreshTokenGrant.php

@@ -10,6 +10,7 @@
 use League\OAuth2\Server\ResponseTypes\ResponseTypeInterface;
 use Psr\Http\Message\ServerRequestInterface;
 use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
+use SimpleSAML\Module\oidc\Server\ResponseTypes\IdTokenResponse;
 
 class RefreshTokenGrant extends OAuth2RefreshTokenGrant
 {
@@ -62,6 +63,7 @@ public function respondToAccessTokenRequest(
             'token',
             [
                 'oldRefreshTokenPrefix' => substr($encryptedRefreshToken, 0, 20),
+                'tokenId' => $responseType instanceof IdTokenResponse ? $responseType->getTokenId() : null,
                 'grantType' => $this->getIdentifier(),
                 'clientId' => $client->getIdentifier()
             ]

lib/Server/ResponseTypes/IdTokenResponse.php

@@ -108,6 +108,7 @@ protected function getExtraParams(AccessTokenEntityInterface $accessToken): arra
             'idToken',
             [
                 'idTokenClaims' => array_keys($token->claims()->all()),
+                'idTokenId' => $token->claims()->get("jti"),
                 'sub' => $token->claims()->get("sub"),
                 'scopes' => $accessToken->getScopes(),
                 'clientId' => $accessToken->getClient()->getIdentifier()
@@ -187,4 +188,9 @@ public function setSessionId(?string $sessionId): void
     {
         $this->sessionId = $sessionId;
     }
+
+    public function getTokenId(): ?string
+    {
+        return $this->accessToken->getIdentifier();
+    }
 }