You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cxf.apache.org by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2021/01/26 06:55:00 UTC
[jira] [Comment Edited] (CXF-8413) OIDC Implicit Flow: id_token not
returned if other response types are included
[ https://issues.apache.org/jira/browse/CXF-8413?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17271911#comment-17271911 ]
Colm O hEigeartaigh edited comment on CXF-8413 at 1/26/21, 6:54 AM:
--------------------------------------------------------------------
You need to add a
[https://github.com/apache/cxf/blob/511907ef4f6d8ac4c4acb9b988c6389e0880dd7e/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenProvider.java]
implementation to OidcImplicitService / OidcHybridService to return IdToken. For example in the systests:
[https://github.com/apache/cxf/blob/a3a49c7ee82f83bc683b898594d5c4948578f25a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oidc/oidc-server-jcache.xml#L76]
was (Author: coheigea):
You need to add the [https://github.com/apache/cxf/blob/master/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/rp/OidcIdTokenProvider.java] class to OidcImplicitService / OidcHybridService to return IdToken. See: [https://github.com/apache/cxf/blob/a3a49c7ee82f83bc683b898594d5c4948578f25a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oidc/oidc-server-jcache.xml#L76]
> OIDC Implicit Flow: id_token not returned if other response types are included
> ------------------------------------------------------------------------------
>
> Key: CXF-8413
> URL: https://issues.apache.org/jira/browse/CXF-8413
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Affects Versions: 3.4.2
> Reporter: Will Croteau
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Labels: OIDC
>
> Per the [OIDC Specification|https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Combinations]:
> {quote}id_token token
> When supplied as the value for the response_type parameter, a successful response MUST include an Access Token, an Access Token Type, and an id_token. The default Response Mode for this Response Type is the fragment encoding and the query encoding MUST NOT be used. Both successful and error responses SHOULD be returned using the supplied Response Mode, or if none is supplied, using the default Response Mode.
> {quote}
> OidcImplicitService and OidcHybridService do not include the id_token in the response if token is also requested.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)