Skip to content

Commit 1937761

Browse files
cicnavicicnavi
committed
Remove no clinet_id ability
1 parent 46ae341 commit 1937761

26 files changed

+405
-109
lines changed

‎config/module_oidc.php.dist‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -526,10 +526,6 @@ $config = [
526526
'openid-credential-offer://',
527527
],
528528

529-
// Allow or disallow clients to request verifiable credentials using Authorization Code Grant without client ID.
530-
// Default is disallowed (false).
531-
ModuleConfig::OPTION_ALLOW_VCI_AUTHORIZATION_CODE_REQUESTS_WITHOUT_CLIENT_ID => false,
532-
533529
// (optional) Credential configuration statements, as per `credential_configurations_supported` claim definition in
534530
// https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#credential-issuer-parameters.
535531
// Check the example below on how this can be used.

‎src/Controllers/AuthorizationController.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,10 @@ public function __invoke(ServerRequestInterface $request): ResponseInterface
5959
{
6060
$queryParameters = $request->getQueryParams();
6161
$state = null;
62+
$this->loggerService->debug('AuthorizationController::invoke: Request parameters: ', $queryParameters);
6263

6364
if (!isset($queryParameters[ProcessingChain::AUTHPARAM])) {
65+
$this->loggerService->debug('AuthorizationController::invoke: No AuthProcId query param.');
6466
$authorizationRequest = $this->authorizationServer->validateAuthorizationRequest($request);
6567
$state = $this->authenticationService->processRequest($request, $authorizationRequest);
6668
// processState will trigger a redirect

‎src/Controllers/VerifiableCredentials/CredentialIssuerCredentialController.php‎

Lines changed: 236 additions & 33 deletions
Large diffs are not rendered by default.

‎src/Factories/AuthorizationServerFactory.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
use SimpleSAML\Module\oidc\Server\Grants\RefreshTokenGrant;
2929
use SimpleSAML\Module\oidc\Server\RequestRules\RequestRulesManager;
3030
use SimpleSAML\Module\oidc\Server\ResponseTypes\TokenResponse;
31+
use SimpleSAML\Module\oidc\Services\LoggerService;
3132

3233
class AuthorizationServerFactory
3334
{
@@ -43,6 +44,7 @@ public function __construct(
4344
private readonly RequestRulesManager $requestRulesManager,
4445
private readonly CryptKey $privateKey,
4546
private readonly PreAuthCodeGrant $preAuthCodeGrant,
47+
private readonly LoggerService $loggerService,
4648
) {
4749
}
4850

@@ -56,6 +58,7 @@ public function build(): AuthorizationServer
5658
$this->moduleConfig->getEncryptionKey(),
5759
$this->tokenResponse,
5860
$this->requestRulesManager,
61+
$this->loggerService,
5962
);
6063

6164
$authorizationServer->enableGrantType(

‎src/ModuleConfig.php‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,6 @@ class ModuleConfig
110110
'auth_sources_to_users_email_attribute_name_map';
111111
final public const OPTION_ISSUER_STATE_TTL = 'issuer_state_ttl';
112112
final public const OPTION_ALLOW_NON_REGISTERED_CLIENTS_FOR_VCI = 'allow_non_registered_clients_for_vci';
113-
final public const OPTION_ALLOW_VCI_AUTHORIZATION_CODE_REQUESTS_WITHOUT_CLIENT_ID =
114-
'allow_vci_authorization_code_requests_without_client_id';
115113
final public const OPTION_ALLOWED_REDIRECT_URI_PREFIXES_FOR_NON_REGISTERED_CLIENTS_FOR_VCI =
116114
'allowed_redirect_uri_prefixes_for_non_registered_clients_for_vci';
117115

@@ -1026,14 +1024,6 @@ public function getAllowNonRegisteredClientsForVci(): bool
10261024
return $this->config()->getOptionalBoolean(self::OPTION_ALLOW_NON_REGISTERED_CLIENTS_FOR_VCI, false);
10271025
}
10281026

1029-
public function getAllowVciAuthorizationCodeRequestsWithoutClientId(): bool
1030-
{
1031-
return $this->config()->getOptionalBoolean(
1032-
self::OPTION_ALLOW_VCI_AUTHORIZATION_CODE_REQUESTS_WITHOUT_CLIENT_ID,
1033-
false,
1034-
);
1035-
}
1036-
10371027
public function getAllowedRedirectUriPrefixesForNonRegisteredClientsForVci(): array
10381028
{
10391029
return $this->config()->getOptionalArray(

‎src/Server/AuthorizationServer.php‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\StateRule;
2626
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\UiLocalesRule;
2727
use SimpleSAML\Module\oidc\Server\RequestTypes\LogoutRequest;
28+
use SimpleSAML\Module\oidc\Services\LoggerService;
2829
use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
2930

3031
class AuthorizationServer extends OAuth2AuthorizationServer
@@ -51,6 +52,7 @@ public function __construct(
5152
Key|string $encryptionKey,
5253
?ResponseTypeInterface $responseType = null,
5354
?RequestRulesManager $requestRulesManager = null,
55+
protected readonly ?LoggerService $loggerService = null,
5456
) {
5557
parent::__construct(
5658
$clientRepository,
@@ -77,6 +79,8 @@ public function __construct(
7779
*/
7880
public function validateAuthorizationRequest(ServerRequestInterface $request): OAuth2AuthorizationRequest
7981
{
82+
$this->loggerService?->debug('AuthorizationServer::validateAuthorizationRequest');
83+
8084
$rulesToExecute = [
8185
StateRule::class,
8286
ClientRule::class,
@@ -91,27 +95,68 @@ public function validateAuthorizationRequest(ServerRequestInterface $request): O
9195
[HttpMethodsEnum::GET, HttpMethodsEnum::POST],
9296
);
9397
} catch (OidcServerException $exception) {
94-
$reason = sprintf("%s %s", $exception->getMessage(), $exception->getHint() ?? '');
98+
$reason = sprintf(
99+
"AuthorizationServer: %s %s",
100+
$exception->getMessage(),
101+
$exception->getHint() ?? '',
102+
);
103+
$this->loggerService?->error($reason);
95104
throw new BadRequest($reason);
96105
}
97106

107+
$this->loggerService?->debug(
108+
'AuthorizationServer: Result bag validated',
109+
['rulesToExecute' => $rulesToExecute],
110+
);
111+
98112
// state and redirectUri is used here, so we can return HTTP redirect error in case of invalid response_type.
99113
/** @var ?string $state */
100114
$state = $resultBag->getOrFail(StateRule::class)->getValue();
101115
/** @var string $redirectUri */
102116
$redirectUri = $resultBag->getOrFail(ClientRedirectUriRule::class)->getValue();
103117

104118
foreach ($this->enabledGrantTypes as $grantType) {
119+
$this->loggerService?->debug(
120+
'AuthorizationServer: Checking if grant type can respond to authorization request: ' .
121+
$grantType::class,
122+
);
105123
if ($grantType->canRespondToAuthorizationRequest($request)) {
124+
$this->loggerService?->debug(
125+
'AuthorizationServer: Grant type can respond to authorization request: ' .
126+
$grantType::class,
127+
);
128+
106129
if (! $grantType instanceof AuthorizationValidatableWithRequestRules) {
130+
$this->loggerService?->error(
131+
'AuthorizationServer: grant type must be validatable with ' .
132+
'already validated result bag: ' . $grantType::class,
133+
);
107134
throw OidcServerException::serverError('grant type must be validatable with already validated ' .
108135
'result bag');
109136
}
110137

138+
$this->loggerService?->debug(
139+
sprintf(
140+
'AuthorizationServer: Grant type class: %s, identifier: %s ',
141+
$grantType::class,
142+
$grantType->getIdentifier(),
143+
),
144+
);
145+
111146
return $grantType->validateAuthorizationRequestWithRequestRules($request, $resultBag);
147+
} else {
148+
$this->loggerService?->debug(
149+
'AuthorizationServer: Grant type can NOT respond to ' .
150+
'authorization request: ' . $grantType::class,
151+
);
112152
}
113153
}
114154

155+
$this->loggerService?->error(
156+
'AuthorizationServer: Not a single registered grant type can respond to authorization ' .
157+
'request.',
158+
['requestQueryParams' => $request->getQueryParams()],
159+
);
115160
throw OidcServerException::unsupportedResponseType($redirectUri, $state);
116161
}
117162

‎src/Server/Grants/AuthCodeGrant.php‎

Lines changed: 66 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,8 @@ public function __construct(
204204
*/
205205
public function canRespondToAuthorizationRequest(ServerRequestInterface $request): bool
206206
{
207+
$this->loggerService->debug('AuthCodeGrant::canRespondToAuthorizationRequest');
208+
207209
$requestParams = $this->requestParamsResolver->getAllBasedOnAllowedMethods(
208210
$request,
209211
$this->allowedAuthorizationHttpMethods,
@@ -732,6 +734,8 @@ public function validateAuthorizationRequestWithRequestRules(
732734
ServerRequestInterface $request,
733735
ResultBagInterface $resultBag,
734736
): OAuth2AuthorizationRequest {
737+
$this->loggerService->debug('AuthCodeGrant::validateAuthorizationRequestWithRequestRules');
738+
735739
$rulesToExecute = [
736740
ClientIdRule::class,
737741
RequestObjectRule::class,
@@ -758,6 +762,12 @@ public function validateAuthorizationRequestWithRequestRules(
758762
/** @var \SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface $client */
759763
$client = $resultBag->getOrFail(ClientRule::class)->getValue();
760764

765+
$this->loggerService->debug('AuthCodeGrant: Resolved data:', [
766+
'redirectUri' => $redirectUri,
767+
'state' => $state,
768+
'clientId' => $client->getIdentifier(),
769+
]);
770+
761771
// Some rules have to have certain things available in order to work properly...
762772
$this->requestRulesManager->setData('default_scope', $this->defaultScope);
763773
$this->requestRulesManager->setData('scope_delimiter_string', self::SCOPE_DELIMITER_STRING);
@@ -769,9 +779,13 @@ public function validateAuthorizationRequestWithRequestRules(
769779
$this->allowedAuthorizationHttpMethods,
770780
);
771781

782+
$this->loggerService->debug('AuthCodeGrant: executed rules.', ['rulesToExecute' => $rulesToExecute]);
783+
772784
/** @var \League\OAuth2\Server\Entities\ScopeEntityInterface[] $scopes */
773785
$scopes = $resultBag->getOrFail(ScopeRule::class)->getValue();
774786

787+
$this->loggerService->debug('AuthCodeGrant: Resolved scopes: ', ['scopes' => $scopes]);
788+
775789
$oAuth2AuthorizationRequest = new OAuth2AuthorizationRequest();
776790

777791
$oAuth2AuthorizationRequest->setClient($client);
@@ -786,42 +800,66 @@ public function validateAuthorizationRequestWithRequestRules(
786800
/** @var ?string $codeChallenge */
787801
$codeChallenge = $resultBag->getOrFail(CodeChallengeRule::class)->getValue();
788802
if ($codeChallenge) {
803+
$this->loggerService->debug('AuthCodeGrant: Code challenge: ', [
804+
'codeChallenge' => $codeChallenge,
805+
]);
789806
/** @var string $codeChallengeMethod */
790807
$codeChallengeMethod = $resultBag->getOrFail(CodeChallengeMethodRule::class)->getValue();
791808

792809
$oAuth2AuthorizationRequest->setCodeChallenge($codeChallenge);
793810
$oAuth2AuthorizationRequest->setCodeChallengeMethod($codeChallengeMethod);
811+
} else {
812+
$this->loggerService->debug('AuthCodeGrant: No code challenge present.');
794813
}
795814

815+
$isOidcCandidate = $this->isOidcCandidate($oAuth2AuthorizationRequest);
816+
817+
818+
819+
$this->loggerService->debug('AuthCodeGrant: Is OIDC candidate: ', [
820+
'isOidcCandidate' => $isOidcCandidate,
821+
]);
822+
796823
$isVciAuthorizationCodeRequest = $this->requestParamsResolver->isVciAuthorizationCodeRequest(
797824
$request,
798825
$this->allowedAuthorizationHttpMethods,
799826
);
800827

828+
$this->loggerService->debug('AuthCodeGrant: Is VCI authorization code request: ', [
829+
'isVciAuthorizationCodeRequest' => $isVciAuthorizationCodeRequest,
830+
]);
831+
832+
801833
if (
802-
(! $this->isOidcCandidate($oAuth2AuthorizationRequest)) &&
834+
(! $isOidcCandidate) &&
803835
(! $isVciAuthorizationCodeRequest)
804836
) {
837+
$this->loggerService->debug('Not an OIDC nor VCI request, returning as OAuth2 request.');
805838
return $oAuth2AuthorizationRequest;
806839
}
807840

841+
$this->loggerService->debug('AuthCodeGrant: OIDC or VCI request, continuing with request setup.');
842+
808843
$authorizationRequest = AuthorizationRequest::fromOAuth2AuthorizationRequest($oAuth2AuthorizationRequest);
809844

810845
$nonce = $this->requestParamsResolver->getAsStringBasedOnAllowedMethods(
811846
ParamsEnum::Nonce->value,
812847
$request,
813848
$this->allowedAuthorizationHttpMethods,
814849
);
850+
$this->loggerService->debug('AuthCodeGrant: Nonce: ', ['nonce' => $nonce]);
815851
if ($nonce !== null) {
816852
$authorizationRequest->setNonce($nonce);
817853
}
818854

819855
$maxAge = $resultBag->get(MaxAgeRule::class);
856+
$this->loggerService->debug('AuthCodeGrant: MaxAge: ', ['maxAge' => $maxAge]);
820857
if (null !== $maxAge) {
821858
$authorizationRequest->setAuthTime((int) $maxAge->getValue());
822859
}
823860

824861
$requestClaims = $resultBag->get(RequestedClaimsRule::class);
862+
$this->loggerService->debug('AuthCodeGrant: Requested claims: ', ['requestClaims' => $requestClaims]);
825863
if (null !== $requestClaims) {
826864
/** @var ?array $requestClaimValues */
827865
$requestClaimValues = $requestClaims->getValue();
@@ -832,35 +870,54 @@ public function validateAuthorizationRequestWithRequestRules(
832870

833871
/** @var array|null $acrValues */
834872
$acrValues = $resultBag->getOrFail(AcrValuesRule::class)->getValue();
873+
$this->loggerService->debug('AuthCodeGrant: ACR values: ', ['acrValues' => $acrValues]);
835874
$authorizationRequest->setRequestedAcrValues($acrValues);
836875

837876

838877
$authorizationRequest->setIsVciRequest($isVciAuthorizationCodeRequest);
839-
$authorizationRequest->setFlowType(
840-
$isVciAuthorizationCodeRequest ?
841-
FlowTypeEnum::VciAuthorizationCode :
842-
FlowTypeEnum::OidcAuthorizationCode,
843-
);
878+
$flowType = $isVciAuthorizationCodeRequest ?
879+
FlowTypeEnum::VciAuthorizationCode : FlowTypeEnum::OidcAuthorizationCode;
880+
$this->loggerService->debug('AuthCodeGrant: FlowType: ', ['flowType' => $flowType]);
881+
$authorizationRequest->setFlowType($flowType);
844882

845883
/** @var ?string $issuerState */
846884
$issuerState = $resultBag->get(IssuerStateRule::class)?->getValue();
885+
$this->loggerService->debug('AuthCodeGrant: Issuer state: ', ['issuerState' => $issuerState]);
847886
$authorizationRequest->setIssuerState($issuerState);
848887

849888
/** @var ?array $authorizationDetails */
850889
$authorizationDetails = $resultBag->get(AuthorizationDetailsRule::class)?->getValue();
890+
$this->loggerService->debug(
891+
'AuthCodeGrant: Authorization details: ',
892+
['authorizationDetails' => $authorizationDetails],
893+
);
851894
$authorizationRequest->setAuthorizationDetails($authorizationDetails);
852895

853896
// Check if we are using a generic client for this request. This can happen for non-registered clients
854897
// in VCI flows. This can be removed once the VCI clients (wallets) are properly registered using DCR.
855898
if ($client->isGeneric()) {
899+
$this->loggerService->debug(
900+
'AuthCodeGrant: Generic client is used for authorization request.',
901+
['genericClientId' => $client->getIdentifier()],
902+
);
856903
// The generic client was used. Make sure to store actually used client_id and redirect_uri params.
857-
/** @var string $clientId */
858-
$clientId = $resultBag->getOrFail(ClientIdRule::class)->getValue();
859-
$authorizationRequest->setBoundClientId($clientId);
904+
/** @var string $clientIdParam */
905+
$clientIdParam = $resultBag->getOrFail(ClientIdRule::class)->getValue();
906+
$this->loggerService->debug(
907+
'AuthCodeGrant: Binding client_id param to request: ',
908+
['clientIdParam' => $clientIdParam],
909+
);
910+
$authorizationRequest->setBoundClientId($clientIdParam);
860911

912+
$this->loggerService->debug(
913+
'AuthCodeGrant: Binding redirect_uri param to request: ',
914+
['redirectUri' => $redirectUri],
915+
);
861916
$authorizationRequest->setBoundRedirectUri($redirectUri);
862917
}
863918

919+
$this->loggerService->debug('AuthCodeGrant: Finished setting up authorization request.');
920+
864921
return $authorizationRequest;
865922
}
866923

0 commit comments

Comments
 (0)