Skip to content

Commit f7db44f

Browse files
mrvanesmrvanes
committed
Reflect issuer_state in access_token
1 parent 092bf54 commit f7db44f

File tree

12 files changed

+90
-39
lines changed

12 files changed

+90
-39
lines changed

‎src/Entities/AccessTokenEntity.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ public function __construct(
7474
protected readonly ?array $authorizationDetails = null,
7575
protected readonly ?string $boundClientId = null,
7676
protected readonly ?string $boundRedirectUri = null,
77+
protected ?string $issuerState = null,
7778
) {
7879
$this->setIdentifier($id);
7980
$this->setClient($clientEntity);
@@ -89,6 +90,7 @@ public function __construct(
8990
$this->revoke();
9091
}
9192
$jwtConfiguration !== null ? $this->jwtConfiguration = $jwtConfiguration : $this->initJwtConfiguration();
93+
$this->issuerState = $issuerState;
9294
}
9395

9496
/**
@@ -125,6 +127,7 @@ public function getState(): array
125127
null,
126128
'bound_client_id' => $this->boundClientId,
127129
'bound_redirect_uri' => $this->boundRedirectUri,
130+
'issuer_state' => $this->issuerState,
128131
];
129132
}
130133

@@ -166,6 +169,9 @@ protected function convertToJWT(): Token
166169
->expiresAt($this->getExpiryDateTime())
167170
->relatedTo((string) $this->getUserIdentifier())
168171
->withClaim('scopes', $this->getScopes());
172+
if ($this->issuerState !== null) {
173+
$jwtBuilder = $jwtBuilder->withClaim('issuer_state', $this->issuerState);
174+
}
169175

170176
return $this->jsonWebTokenBuilderService->getSignedProtocolJwt($jwtBuilder);
171177
}

‎src/Entities/AuthCodeEntity.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,12 @@ class AuthCodeEntity implements AuthCodeEntityInterface, MementoInterface
3232
use OidcAuthCodeTrait;
3333
use RevokeTokenTrait;
3434

35+
/**
36+
* issuer state
37+
* @var string $issuerState
38+
*/
39+
protected ?string $issuerState = null;
40+
3541
/**
3642
* @param \League\OAuth2\Server\Entities\ScopeEntityInterface[] $scopes
3743
*/
@@ -49,6 +55,7 @@ public function __construct(
4955
protected readonly ?array $authorizationDetails = null,
5056
protected readonly ?string $boundClientId = null,
5157
protected readonly ?string $boundRedirectUri = null,
58+
protected ?string $issuer_state = null,
5259
) {
5360
$this->identifier = $id;
5461
$this->client = $client;
@@ -58,6 +65,7 @@ public function __construct(
5865
$this->redirectUri = $redirectUri;
5966
$this->nonce = $nonce;
6067
$this->isRevoked = $isRevoked;
68+
$this->issuerState = $issuer_state;
6169
}
6270

6371
/**
@@ -81,6 +89,7 @@ public function getState(): array
8189
null,
8290
'bound_client_id' => $this->boundClientId,
8391
'bound_redirect_uri' => $this->boundRedirectUri,
92+
'issuer_state' => $this->issuerState,
8493
];
8594
}
8695

@@ -113,4 +122,10 @@ public function getBoundRedirectUri(): ?string
113122
{
114123
return $this->boundRedirectUri;
115124
}
125+
126+
public function getIssuerState(): ?string
127+
{
128+
return $this->issuerState;
129+
}
130+
116131
}

‎src/Factories/Entities/AccessTokenEntityFactory.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ public function fromData(
4040
?array $authorizationDetails = null,
4141
?string $boundClientId = null,
4242
?string $boundRedirectUri = null,
43+
?string $issuerState = null,
4344
): AccessTokenEntity {
4445
return new AccessTokenEntity(
4546
$id,
@@ -56,6 +57,7 @@ public function fromData(
5657
authorizationDetails: $authorizationDetails,
5758
boundClientId: $boundClientId,
5859
boundRedirectUri: $boundRedirectUri,
60+
issuerState: $issuerState,
5961
);
6062
}
6163

‎src/Factories/Entities/AuthCodeEntityFactory.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ public function fromData(
3131
?string $userIdentifier = null,
3232
?string $redirectUri = null,
3333
?string $nonce = null,
34+
?string $issuer_state = null,
3435
bool $isRevoked = false,
3536
?FlowTypeEnum $flowTypeEnum = null,
3637
?string $txCode = null,
@@ -52,6 +53,7 @@ public function fromData(
5253
$authorizationDetails,
5354
$boundClientId,
5455
$boundRedirectUri,
56+
$issuer_state,
5557
);
5658
}
5759

@@ -94,6 +96,7 @@ public function fromState(array $state): AuthCodeEntity
9496
$isRevoked = (bool) $state['is_revoked'];
9597
$flowType = empty($state['flow_type']) ? null : FlowTypeEnum::tryFrom((string)$state['flow_type']);
9698
$txCode = empty($state['tx_code']) ? null : (string)$state['tx_code'];
99+
$issuerState = (string) $state['issuer_state'];
97100

98101
/** @psalm-suppress MixedAssignment */
99102
$authorizationDetails = isset($state['authorization_details']) && is_string($state['authorization_details']) ?
@@ -112,6 +115,7 @@ public function fromState(array $state): AuthCodeEntity
112115
$userIdentifier,
113116
$redirectUri,
114117
$nonce,
118+
$issuerState,
115119
$isRevoked,
116120
$flowType,
117121
$txCode,

‎src/Factories/RequestRulesManagerFactory.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\CodeChallengeRule;
2525
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\CodeVerifierRule;
2626
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IdTokenHintRule;
27-
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IssuerStateRule;
2827
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\MaxAgeRule;
2928
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\PostLogoutRedirectUriRule;
3029
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\PromptRule;
@@ -36,6 +35,7 @@
3635
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\ScopeOfflineAccessRule;
3736
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\ScopeRule;
3837
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\StateRule;
38+
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IssuerStateRule;
3939
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\UiLocalesRule;
4040
use SimpleSAML\Module\oidc\Services\AuthenticationService;
4141
use SimpleSAML\Module\oidc\Services\LoggerService;
@@ -89,6 +89,7 @@ private function getDefaultRules(): array
8989
{
9090
return [
9191
new StateRule($this->requestParamsResolver, $this->helpers),
92+
new IssuerStateRule($this->requestParamsResolver, $this->helpers),
9293
new ClientRule(
9394
$this->requestParamsResolver,
9495
$this->helpers,
@@ -147,7 +148,6 @@ private function getDefaultRules(): array
147148
$this->protocolCache,
148149
),
149150
new CodeVerifierRule($this->requestParamsResolver, $this->helpers),
150-
new IssuerStateRule($this->requestParamsResolver, $this->helpers, $this->issuerStateRepository),
151151
new AuthorizationDetailsRule($this->requestParamsResolver, $this->helpers, $this->moduleConfig),
152152
new ClientIdRule($this->requestParamsResolver, $this->helpers),
153153
];

‎src/Repositories/AccessTokenRepository.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,8 @@ public function persistNewAccessToken(OAuth2AccessTokenEntityInterface $accessTo
113113
flow_type,
114114
authorization_details,
115115
bound_client_id,
116-
bound_redirect_uri
116+
bound_redirect_uri,
117+
issuer_state
117118
) "
118119
. "VALUES (
119120
:id,
@@ -127,7 +128,8 @@ public function persistNewAccessToken(OAuth2AccessTokenEntityInterface $accessTo
127128
:flow_type,
128129
:authorization_details,
129130
:bound_client_id,
130-
:bound_redirect_uri
131+
:bound_redirect_uri,
132+
:issuer_state
131133
)",
132134
$this->getTableName(),
133135
);
@@ -267,7 +269,7 @@ private function update(AccessTokenEntity $accessTokenEntity): void
267269
. "client_id = :client_id, is_revoked = :is_revoked, auth_code_id = :auth_code_id, "
268270
. "requested_claims = :requested_claims, flow_type = :flow_type, " .
269271
"authorization_details = :authorization_details, bound_client_id = :bound_client_id, " .
270-
"bound_redirect_uri = :bound_redirect_uri WHERE id = :id",
272+
"bound_redirect_uri = :bound_redirect_uri, issuer_state = :issuer_state WHERE id = :id",
271273
$this->getTableName(),
272274
);
273275

‎src/Repositories/AuthCodeRepository.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,8 @@ public function persistNewAuthCode(OAuth2AuthCodeEntityInterface $authCodeEntity
8484
tx_code,
8585
authorization_details,
8686
bound_client_id,
87-
bound_redirect_uri
87+
bound_redirect_uri,
88+
issuer_state
8889
) VALUES (
8990
:id,
9091
:scopes,
@@ -98,7 +99,8 @@ public function persistNewAuthCode(OAuth2AuthCodeEntityInterface $authCodeEntity
9899
:tx_code,
99100
:authorization_details,
100101
:bound_client_id,
101-
:bound_redirect_uri
102+
:bound_redirect_uri,
103+
:issuer_state
102104
)
103105
EOS,
104106
$this->getTableName(),
@@ -224,7 +226,8 @@ private function update(AuthCodeEntity $authCodeEntity): void
224226
tx_code = :tx_code,
225227
authorization_details = :authorization_details,
226228
bound_client_id = :bound_client_id,
227-
bound_redirect_uri = :bound_redirect_uri
229+
bound_redirect_uri = :bound_redirect_uri,
230+
issuer_state = :issuer_state
228231
WHERE id = :id
229232
EOS
230233
,

‎src/Server/AuthorizationServer.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IdTokenHintRule;
2424
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\PostLogoutRedirectUriRule;
2525
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\StateRule;
26+
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IssuerStateRule;
2627
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\UiLocalesRule;
2728
use SimpleSAML\Module\oidc\Server\RequestTypes\LogoutRequest;
2829
use SimpleSAML\Module\oidc\Services\LoggerService;
@@ -83,6 +84,7 @@ public function validateAuthorizationRequest(ServerRequestInterface $request): O
8384

8485
$rulesToExecute = [
8586
StateRule::class,
87+
IssuerStateRule::class,
8688
ClientRule::class,
8789
ClientRedirectUriRule::class,
8890
];

‎src/Server/Grants/AuthCodeGrant.php‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@
5252
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\CodeChallengeMethodRule;
5353
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\CodeChallengeRule;
5454
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\CodeVerifierRule;
55-
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IssuerStateRule;
5655
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\MaxAgeRule;
5756
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\PromptRule;
5857
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\RequestedClaimsRule;
@@ -61,6 +60,7 @@
6160
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\ScopeOfflineAccessRule;
6261
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\ScopeRule;
6362
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\StateRule;
63+
use SimpleSAML\Module\oidc\Server\RequestRules\Rules\IssuerStateRule;
6464
use SimpleSAML\Module\oidc\Server\RequestTypes\AuthorizationRequest;
6565
use SimpleSAML\Module\oidc\Server\ResponseTypes\Interfaces\AcrResponseTypeInterface;
6666
use SimpleSAML\Module\oidc\Server\ResponseTypes\Interfaces\AuthTimeResponseTypeInterface;
@@ -347,6 +347,7 @@ protected function issueOidcAuthCode(
347347
$userIdentifier,
348348
$redirectUri,
349349
$authorizationRequest->getNonce(),
350+
$authorizationRequest->getIssuerState(),
350351
flowTypeEnum: $flowType,
351352
authorizationDetails: $authorizationRequest->getAuthorizationDetails(),
352353
boundClientId: $authorizationRequest->getBoundClientId(),
@@ -603,6 +604,12 @@ public function respondToAccessTokenRequest(
603604
json_decode(json_encode($authCodePayload->claims, JSON_THROW_ON_ERROR), true, 512, JSON_THROW_ON_ERROR)
604605
: null;
605606

607+
$auth_code_id = $authCodePayload->auth_code_id;
608+
$authCodeEntity = $this->authCodeRepository->findById($auth_code_id);
609+
610+
/** @var string $issuerState */
611+
$issuerState = $authCodeEntity->getIssuerState();
612+
606613
// Issue and persist new access token
607614
$accessToken = $this->issueAccessToken(
608615
$accessTokenTTL,
@@ -615,6 +622,7 @@ public function respondToAccessTokenRequest(
615622
$storedAuthCodeEntity->getAuthorizationDetails(),
616623
$storedAuthCodeEntity->getBoundClientId(),
617624
$storedAuthCodeEntity->getBoundRedirectUri(),
625+
$issuerState,
618626
);
619627
$this->getEmitter()->emit(new RequestEvent(RequestEvent::ACCESS_TOKEN_ISSUED, $request));
620628
$responseType->setAccessToken($accessToken);
@@ -759,6 +767,8 @@ public function validateAuthorizationRequestWithRequestRules(
759767
$redirectUri = $resultBag->getOrFail(ClientRedirectUriRule::class)->getValue();
760768
/** @var string|null $state */
761769
$state = $resultBag->getOrFail(StateRule::class)->getValue();
770+
/** @var string|null $issuer_state */
771+
$issuer_state = $resultBag->getOrFail(IssuerStateRule::class)->getValue();
762772
/** @var \SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface $client */
763773
$client = $resultBag->getOrFail(ClientRule::class)->getValue();
764774

@@ -881,9 +891,9 @@ public function validateAuthorizationRequestWithRequestRules(
881891
$authorizationRequest->setFlowType($flowType);
882892

883893
/** @var ?string $issuerState */
884-
$issuerState = $resultBag->get(IssuerStateRule::class)?->getValue();
885-
$this->loggerService->debug('AuthCodeGrant: Issuer state: ', ['issuerState' => $issuerState]);
886-
$authorizationRequest->setIssuerState($issuerState);
894+
if ($issuer_state !== null) {
895+
$authorizationRequest->setIssuerState($issuer_state);
896+
}
887897

888898
/** @var ?array $authorizationDetails */
889899
$authorizationDetails = $resultBag->get(AuthorizationDetailsRule::class)?->getValue();

‎src/Server/Grants/Traits/IssueAccessTokenTrait.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ protected function issueAccessToken(
5555
?array $authorizationDetails = null,
5656
?string $boundClientId = null,
5757
?string $boundRedirectUri = null,
58+
?string $issuerState = null,
5859
): AccessTokenEntityInterface {
5960
$maxGenerationAttempts = AbstractGrant::MAX_RANDOM_TOKEN_GENERATION_ATTEMPTS;
6061

@@ -79,6 +80,7 @@ protected function issueAccessToken(
7980
authorizationDetails: $authorizationDetails,
8081
boundClientId: $boundClientId,
8182
boundRedirectUri: $boundRedirectUri,
83+
issuerState: $issuerState
8284
);
8385
$this->accessTokenRepository->persistNewAccessToken($accessToken);
8486
return $accessToken;

0 commit comments

Comments
 (0)