Open AlbinoDrought opened 1 year ago
Could you show the payload that gets sent by the client? :) That would be tremendously helpful!
Hello,
Here's the payload that gets sent:
PUT http://hydra:4445/admin/clients/af60e02b-f5a2-47c0-ba79-23d1937b8dfd
{"allowed_cors_origins":[],"audience":[],"client_id":"af60e02b-f5a2-47c0-ba79-23d1937b8dfd","client_name":"","client_secret_expires_at":0,"client_uri":"","contacts":[],"created_at":"2022-11-09T01:00:36+00:00","grant_types":[],"jwks":[],"logo_uri":"","metadata":[],"owner":"","policy_uri":"","redirect_uris":[],"response_types":[],"scope":"offline_access offline openid","subject_type":"public","token_endpoint_auth_method":"client_secret_basic","tos_uri":"","updated_at":"2022-11-09T01:00:35+00:00","userinfo_signed_response_alg":"none"}
(the important part is probably "jwks":[]
- jwks
is getting serialized as an array)
I've also dumped a repro here: https://github.com/AlbinoDrought/repro-ory-sdk-224
Cheers!
Loosely related, but adminRevokeOAuth2ConsentSessions*
also has a serialization issue:
/**
* Create request for operation 'adminRevokeOAuth2ConsentSessions'
*
* @param string $subject The subject (Subject) whose consent sessions should be deleted. (required)
* @param string $client If set, deletes only those consent sessions by the Subject that have been granted to the specified OAuth 2.0 Client ID (optional)
* @param bool $all If set to `true` deletes all consent sessions by the Subject that have been granted. (optional)
*
* @throws \InvalidArgumentException
* @return \GuzzleHttp\Psr7\Request
*/
public function adminRevokeOAuth2ConsentSessionsRequest($subject, $client = null, $all = null)
{
// [ ...]
// query params
if ($all !== null) {
if('form' === 'form' && is_array($all)) {
foreach($all as $key => $value) {
$queryParams[$key] = $value;
}
}
else {
$queryParams['all'] = $all;
}
}
// [...]
}
$all
is typed as bool
, but gets serialized to 1
in the query string.
Hydra explicitly checks for "true'
, causing a 400 Bad Request to be emitted when it receives the "1":
{
"class": "Ory\\Client\\ApiException",
"message": "[400] Client error: DELETE http://hydra:4445/admin/oauth2/auth/sessions/consent?subject=1234&all=1 resulted in a 400 Bad Request response:\n{\"error\":\"invalid_request\",\"error_description\":\"The request is missing a required parameter, includes an invalid paramet (truncated...)\n",
"code": 400,
"file": "/app/vendor/ory/client/lib/Api/V0alpha2Api.php:11172",
"trace": [
"/app/vendor/ory/client/lib/Api/V0alpha2Api.php:11147",
"..."
]
}
Passing "true" would probably work but this gets rejected by static analysis tools:
ERROR: InvalidScalarArgument - Argument 3 of Ory\Client\Api\V0alpha2Api::adminRevokeOAuth2ConsentSessions expects bool|null, "true" provided (see https://psalm.dev/012) $this->client->adminRevokeOAuth2ConsentSessions($id, null, "true");
Preflight checklist
Describe the bug
The PHP version of
ory/client:v0.2.0-alpha.60
sends invalidjwks
property in the below scenario:Reproducing the bug
Setup:
Reproduce:
Relevant log output
Relevant configuration
No response
Version
ory/client:v0.2.0-alpha.60, hydra 2.0.1
On which operating system are you observing this issue?
Linux
In which environment are you deploying?
Docker
Additional Context
Can be worked around with
$client->setJwks((object)[]);
or$client->setJwks(null);