search

ging / fiware-idm

OAuth 2.0-based authentication of users and devices, user profile management, Single Sign-On (SSO) and Identity Federation across multiple administration domains.
https://keyrock-fiware.github.io
MIT License
37 stars 81 forks source link

Potential bug in assert_client_using_jwt(extparticipant) #338

Closed MarkusPfundstein closed 1 year ago

MarkusPfundstein commented 1 year ago

Hi everyone,

I have the following config.pr

config.pr = {
    url: "https://mw.i4trustsat.ishareworks.nl",
    id: "EU.EORI.NLi4TRUSTSAT",
    parties_endpoint: undefined,
    token_endpoint: undefined,
    client_id: "EU.EORI.NL03000023",
    client_key: "...",
    client_crt: "..."
}

The id is the id of our iShare Satellite. The client_id is the id of our entitled party.

In line 109 in controllers/extparticipant/utils.js#109, a check is made that the aud in the jwt is set correctly. In the current MASTER, it is compared to the config.pr.client_id, which corresponds to the EORI of the entitled party. However in iShare, the aud should be set to the satellite EORI.

Hence instead of config.pr.client_id, it should be compared with config.pr.id

    if (aud == null || aud.indexOf(config.pr.id) === -1) {
      throw new Error('Not listed on the aud parameter');
    }

Implementing this change allows me to successfuly retrieve an access_token and id_token with the following call: afbeelding

My question is: Is that correct or do I miss something here?