OpenConext / Mujina

A mock IDP and SP using the OpenSAML library
Apache License 2.0
369 stars 166 forks source link

/api/entityid doesn't properly process JSON strings #67

Open veselov opened 3 years ago

veselov commented 3 years ago

Input data to /api/entityid (and similar endpoints that accept a single string), don't quite make sense me. The endpoint accepts JSON, so I am expected to send a valid JSON data.

However, the schema for that data is just string. So the only valid JSON data I can send is a JSON string (e.g. "abc"). However, if I do so, the entire value I sent is treated as the entity ID (including the quotation marks). I'm, therefore forced to send the string without the quotation marks, which makes my input not valid JSON data, and disagrees with the content type of the request data.

Using text/plain content type causes the server to reject the request.

P.S. I'm not entirely sure this is Mujina's issue, looking at the code, it's all Spring annotations. However, I don't know much about Spring, so may be there is a way to configure this (i.e. it's not a Spring bug).

oharsta commented 3 years ago

A single string is valid JSON. If I run Mujina IdP locally and use the API:

curl -v -H "Accept: application/json"  -H "Content-type: application/json"  -X PUT -d "myEntityId"  http://localhost:8080/api/entityid

Then the entityId is changed and the log outputs the following:

INFO  mujina.api.IdpController - Request to set entityID myEntityId
veselov commented 3 years ago

A valid json string requires to be wrapped in double quotes ("), according to https://www.json.org/. What you've sent in your CURL command above is entityId, as the double quote characters you've specified in the command are interpreted by the shell. If you used:

curl -v -H "Accept: application/json"  -H "Content-type: application/json"  -X PUT -d '"myEntityId"'  http://localhost:8080/api/entityid

you'd see the cluster name set to "myEntityId" instead, because the value is not interpreted as a JSON string, but as a literal string.