Compare client_id against grant's client

IdentityPython / oidc-op

An implementation of an OIDC Provider (OP)

Apache License 2.0

65 stars 27 forks source link

Compare client_id against grant's client #123

Closed nsklikas closed 3 years ago

nsklikas commented 3 years ago

A client could take a token from another client and use it as his own.

rohe commented 3 years ago

So, this was one of the things I fixed in the code as a result of the conformance testing. Different solution from your proposal though. Have to compare.

peppelinux commented 3 years ago

in django-oidc-op and the satosa frontend based in oidcop, due to their storage logic based on flush/dump/load/ method of session_manager, this problem is fixed by design. Here the test

https://github.com/peppelinux/SATOSA/commit/df6e9a880394422ef84afb4b672d6d28b0223e43#diff-f10182b97d02a823560e9df6c1f6b5d316c9a6778db6a2f6050bcc03337c3d67R765

anyway this PR is very important for who use oidcop with a pure inmemory storage or another inherited engine from inmemory interfaces, good job @nsklikas

rohe commented 3 years ago

There are 2 differences between @nsklikas proposal and mine. I picked client_id from the session_info so my check happens a couple of lines earlier then @nsklikas's I use the error code invalid_grant which explicitly lists 'or was issued to another client.' as the cause of the error.

I've added the new tests to my branch since I think we should choose that one instead of this. My 2 cents.

nsklikas commented 3 years ago

Your solution sounds better. I will close this PR once you open one with your changes.