search

eclipse-vertx / vertx-auth

Apache License 2.0
166 stars 156 forks source link

OAuth2 Auth provider incorrectly validating Access Tokens #673

Closed fposch closed 1 month ago

fposch commented 9 months ago

Motivation:

PR containing code for fix in #654

vietj commented 9 months ago

I can't see any test for this

vietj commented 9 months ago

@pmlopes could you have a look ?

fposch commented 9 months ago

I can't see any test for this

I didn't write a test because I couldn't see any for the provider. A full maven build for the whole vertx-auth module passes locally but that's as far as I ran tests locally.

fposch commented 9 months ago

Test issues partially fixed, reusing the audience ArrayList from JWTOptions did unintendedly modify its content, using a copy now.

fposch commented 9 months ago

Now only the following two tests are failing in OAuth2Keycloak14IT

Tests are expecting validation to fail but that isn't happening with the suggested ID-token-only validation. I don't want to tamper with existing tests too much, so your opinion on this one would be appreciated.

fposch commented 8 months ago

@pmlopes @vietj May I ask for an update?

My recent changes to suggested fix from https://github.com/eclipse-vertx/vertx-auth/issues/654 did resolve some of the regression but the ones are broken with new logic only validating ID-tokens. Writing a meaningful test is above my paygrade and I wouldn't dare to just remove the test cases.

Let me know what you think,

fposch commented 4 months ago

There hasn't been any reply, neither on the related issue nor here for months and I'm not sure how else to address this.

fposch commented 1 month ago

We decided to tackle this issue by this issue by managing audiences in our application in a controlled manner, so no need to fix token handling from our perspective -> closing the PR and leave it to the creator of the related issue how to deal with it.

See also https://github.com/eclipse-vertx/vertx-auth/issues/654