Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error handling in OIDC authenticator #161

Merged
merged 1 commit into from
Nov 15, 2023
Merged

Error handling in OIDC authenticator #161

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions ...a/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@
import org.wso2.carbon.identity.application.authentication.framework.model.AdditionalData;
import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatedUser;
import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatorData;
import org.wso2.carbon.identity.application.authentication.framework.model.AuthenticatorMessage;
import org.wso2.carbon.identity.application.authentication.framework.util.FrameworkConstants;
import org.wso2.carbon.identity.application.authentication.framework.util.FrameworkUtils;
import org.wso2.carbon.identity.application.authenticator.oidc.internal.OpenIDConnectAuthenticatorDataHolder;
Expand Down Expand Up @@ -135,6 +136,7 @@ public class OpenIDConnectAuthenticator extends AbstractApplicationAuthenticator
private static final String REDIRECT_URL = "REDIRECT_URL";
private static Pattern pattern = Pattern.compile(DYNAMIC_PARAMETER_LOOKUP_REGEX);
private static final String[] NON_USER_ATTRIBUTES = new String[]{"at_hash", "iss", "iat", "exp", "aud", "azp"};
private static final String AUTHENTICATOR_MESSAGE = "authenticatorMessage";

@Override
public AuthenticatorFlowStatus process(HttpServletRequest request, HttpServletResponse response,
Expand Down Expand Up @@ -540,6 +542,8 @@ protected void initiateAuthenticationRequest(HttpServletRequest request, HttpSer
if (LOG.isDebugEnabled()) {
LOG.debug(ErrorMessages.RETRIEVING_AUTHENTICATOR_PROPERTIES_FAILED.getMessage());
}
setAuthenticatorMessageToContext(ErrorMessages.RETRIEVING_AUTHENTICATOR_PROPERTIES_FAILED, context);

throw new AuthenticationFailedException(
ErrorMessages.RETRIEVING_AUTHENTICATOR_PROPERTIES_FAILED.getCode(),
ErrorMessages.RETRIEVING_AUTHENTICATOR_PROPERTIES_FAILED.getMessage());
Expand All @@ -548,6 +552,8 @@ protected void initiateAuthenticationRequest(HttpServletRequest request, HttpSer
if (LOG.isDebugEnabled()) {
LOG.debug("Error while encoding the additional query parameters", e);
}
setAuthenticatorMessageToContext(ErrorMessages.BUILDING_AUTHORIZATION_CODE_REQUEST_FAILED, context);

throw new AuthenticationFailedException(ErrorMessages.BUILDING_AUTHORIZATION_CODE_REQUEST_FAILED.getCode(),
e.getMessage(), e);
} catch (IOException e) {
Expand All @@ -559,6 +565,15 @@ protected void initiateAuthenticationRequest(HttpServletRequest request, HttpSer
return;
}

private static void setAuthenticatorMessageToContext(ErrorMessages errorMessage,
AuthenticationContext context) {

AuthenticatorMessage authenticatorMessage = new AuthenticatorMessage(FrameworkConstants.
AuthenticatorMessageType.ERROR, errorMessage.
getCode(), errorMessage.getMessage(), null);
context.setProperty(AUTHENTICATOR_MESSAGE, authenticatorMessage);
}

private String getStateParameter(AuthenticationContext context, Map<String, String> authenticatorProperties) {

String state = context.getContextIdentifier() + "," + OIDCAuthenticatorConstants.LOGIN_TYPE;
Expand Down Expand Up @@ -597,6 +612,8 @@ protected void processAuthenticationResponse(HttpServletRequest request, HttpSer

Map<String, String> authenticatorProperties = context.getAuthenticatorProperties();
if (requiredIDToken(authenticatorProperties) && StringUtils.isBlank(idToken)) {
setAuthenticatorMessageToContext(ErrorMessages.ID_TOKEN_MISSED_IN_OIDC_RESPONSE, context);

throw new AuthenticationFailedException(ErrorMessages.ID_TOKEN_MISSED_IN_OIDC_RESPONSE.getCode(),
String.format(ErrorMessages.ID_TOKEN_MISSED_IN_OIDC_RESPONSE.getMessage(),
getTokenEndpoint(authenticatorProperties),
Expand Down Expand Up @@ -627,6 +644,8 @@ protected void processAuthenticationResponse(HttpServletRequest request, HttpSer
if (LOG.isDebugEnabled()) {
LOG.debug(errorMessage);
}
setAuthenticatorMessageToContext(ErrorMessages.DECODED_JSON_OBJECT_IS_NULL, context);

throw new AuthenticationFailedException(ErrorMessages.DECODED_JSON_OBJECT_IS_NULL.getCode(),
errorMessage);
}
Expand Down Expand Up @@ -654,6 +673,8 @@ protected void processAuthenticationResponse(HttpServletRequest request, HttpSer
LOG.debug("OIDC provider does not support nonce claim in id_token.");
}
if (nonce != null && !nonce.equals(context.getProperty(OIDC_FEDERATION_NONCE))) {
setAuthenticatorMessageToContext(ErrorMessages.NONCE_MISMATCH, context);

throw new AuthenticationFailedException(ErrorMessages.NONCE_MISMATCH.getCode(),
ErrorMessages.NONCE_MISMATCH.getMessage());
}
Expand Down Expand Up @@ -728,6 +749,8 @@ protected void mapAccessToken(HttpServletRequest request, AuthenticationContext
String accessToken = oAuthResponse.getParam(OIDCAuthenticatorConstants.ACCESS_TOKEN);

if (StringUtils.isBlank(accessToken)) {
setAuthenticatorMessageToContext(ErrorMessages.ACCESS_TOKEN_EMPTY_OR_NULL, context);

throw new AuthenticationFailedException(ErrorMessages.ACCESS_TOKEN_EMPTY_OR_NULL.getCode(),
ErrorMessages.ACCESS_TOKEN_EMPTY_OR_NULL.getMessage());
}
Expand Down Expand Up @@ -928,6 +951,8 @@ private Map<String, Object> getIdTokenClaims(AuthenticationContext context, Stri
try {
jwtAttributeSet = JSONObjectUtils.parseJSONObject(new String(decoded)).entrySet();
} catch (ParseException e) {
setAuthenticatorMessageToContext(ErrorMessages.JWT_TOKEN_PARSING_FAILED, context);

LOG.error("Error occurred while parsing JWT provided by federated IDP: ", e);
}
Map<String, Object> jwtAttributeMap = new HashMap();
Expand Down Expand Up @@ -996,6 +1021,7 @@ private String getAuthenticatedUserId(AuthenticationContext context, OAuthClient
}

if (authenticatedUserId == null) {
setAuthenticatorMessageToContext(ErrorMessages.USER_ID_NOT_FOUND_IN_ID_TOKEN_SENT_BY_FEDERATED_IDP, context);
throw new AuthenticationFailedException(
ErrorMessages.USER_ID_NOT_FOUND_IN_ID_TOKEN_SENT_BY_FEDERATED_IDP.getCode(),
ErrorMessages.USER_ID_NOT_FOUND_IN_ID_TOKEN_SENT_BY_FEDERATED_IDP.getMessage());
Expand Down Expand Up @@ -1097,6 +1123,8 @@ protected OAuthClientRequest getAccessTokenRequest(AuthenticationContext context
LOG.debug(String.format(ErrorMessages.BUILDING_ACCESS_TOKEN_REQUEST_FAILED.getMessage(),
tokenEndPoint), e);
}
setAuthenticatorMessageToContext(ErrorMessages.BUILDING_ACCESS_TOKEN_REQUEST_FAILED, context);

throw new AuthenticationFailedException(ErrorMessages.BUILDING_ACCESS_TOKEN_REQUEST_FAILED.getCode(), e);
} catch (URLBuilderException e) {
throw new RuntimeException("Error occurred while building URL in tenant qualified mode.", e);
Expand Down Expand Up @@ -1410,6 +1438,8 @@ protected String getSubjectFromUserIDClaimURI(AuthenticationContext context, Map
LOG.warn("Unable to map subject claim (non-String type): " + subject);
}
} catch (ClaimMetadataException ex) {
setAuthenticatorMessageToContext(ErrorMessages.EXECUTING_CLAIM_TRANSFORMATION_FOR_IDP_FAILED, context);

throw new AuthenticationFailedException(
ErrorMessages.EXECUTING_CLAIM_TRANSFORMATION_FOR_IDP_FAILED.getCode(),
String.format(ErrorMessages.EXECUTING_CLAIM_TRANSFORMATION_FOR_IDP_FAILED.getMessage(),
Expand Down
4 changes: 3 additions & 1 deletion ...java/org/wso2/carbon/identity/application/authenticator/oidc/util/OIDCErrorConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,9 @@ public enum ErrorMessages {
"OID-65016", "Error while validating the iss claim in the jwt token"),
JWT_TOKEN_VALIDATION_FAILED("OID-65016", "JWT token validation Failed."),
JWT_TOKEN_SIGNATURE_VALIDATION_FAILED("OID-65017",
"Error while validating the JWT token signature");
"Error while validating the JWT token signature"),
JWT_TOKEN_PARSING_FAILED("OID-65018",
"Error occurred while parsing JWT provided by federated IDP.");

private final String code;
private final String message;
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,7 +304,7 @@
<identity.application.auth.oidc.package.export.version>${project.version}
</identity.application.auth.oidc.package.export.version>

<carbon.identity.framework.version>5.25.496</carbon.identity.framework.version>
<carbon.identity.framework.version>5.25.508</carbon.identity.framework.version>
<oltu.version>1.0.0.wso2v3</oltu.version>
<json-smart.version>2.4.7</json-smart.version>
<json.wso2.version>3.0.0.wso2v2</json.wso2.version>
Expand Down
Loading