search

rohe / oictest

OAuth2 and OpenID Connect test tools
Other
39 stars 21 forks source link

both jwks and jwks_uri submitting in [Dynamic] (OP-Registration-jwks) #98

Closed panva closed 6 years ago

panva commented 8 years ago

The test labeled Uses keys registered with jwks value [Dynamic] (OP-Registration-jwks) incorrectly submits both claims jwks and jwks_uri to the registration request.

0.659809 ------------ RegistrationRequest ------------
0.660630 --> URL: http://some.herokuapp.com/v1.0/registration
0.660640 --> BODY: {"token_endpoint_auth_method": "private_key_jwt", "subject_type": "public", "jwks_uri": null, "jwks": {"keys": [{"use": "enc", "e": "AQAB", "d": "lZQv0_81euRLeUYU84Aodh0ar7ymDlzWP5NMra4Jklkb-lTBWkI-u4RMsPqGYyW3KHRoL_pgzZXSzQx8RLQfER6timRWb--NxMMKllZubByU3RqH2ooNuocJurspYiXkznPW1Mg9DaNXL0C2hwWPQHTeUVISpjgi5TCOV1ccWVyksFruya_VNL1CIByB-L0GL1rqbKv32cDwi2A3_jJa61cpzfLSIBe-lvCO6tuiDsR4qgJnUwnndQFwEI_4mLmD3iNWXrc8N-poleV8mBfMqBB5fWwy_ZTFCpmQ5AywGmctaik_wNhMoWuA4tUfY6_1LdKld-5Cjq55eLtuJjtvuQ", "n": "tx3Hjdbc19lkTiohbJrNj4jf2_90MEE122CRrwtFu6saDywKcG7Bi7w2FMAK2oTkuWfqhWRb5BEGmnSXdiCEPO5d-ytqP3nwlZXHaCDYscpP8bB4YLhvCn7R8Efw6gwQle24QPRP3lYoFeuUbDUq7GKA5SfaZUvWoeWjqyLIaBspKQsC26_Umx1E4IXLrMSL6nkRnrYcVZBAXrYCeTP1XtsV38_lZVJfHSaJaUy4PKaj3yvgm93EV2CXybPti7CCMXZ34VqqWiF64pQjZsPu3ZTr7ha_TTQq499-zYRQNDvIVsBDLQQIgrbctuGqj6lrXb31Jj3JIEYqH_4h5X9d0Q", "q": "1q-r-bmMFbIzrLK2U3elksZq8CqUqZxlSfkGMZuVkxgYMS-e4FPzEp2iirG-eO11aa0cpMMoBdTnVdGJ_ZUR93w0lGf9XnQAJqxP7eOsrUoiW4VWlWH4WfOiLgpO-pFtyTz_JksYYaotc_Z3Zy-Szw6a39IDbuYGy1qL-15oQuc", "p": "2lrYPppRbcQWu4LtWN6tOVUrtCOPv1eLTKTc7q8vCMcem1Ox5QFB7KnUtNZ5Ni7wnZUeVDfimNebtjNsGvDSrpgIlo9dEnFBQsQIkzZ2SkoYfgmF8hNdi6P-BfRjdgYouy4c6xAnGDgSMTip1YnPRyvbMaoYT9E_tEcBW5wOeoc", "kid": "a0", "kty": "RSA"}, {"use": "sig", "e": "AQAB", "d": "DodXDEtkovWWGsMEXYy_nEEMCWyROMOebCnCv0ey3i4M4bh2dmwqgz0e-IKQAFlGiMkidGL1lNbq0uFS04FbuRAR06dYw1cbrNbDdhrWFxKTd1L5D9p-x-gW-YDWhpI8rUGRa76JXkOSxZUbg09_QyUd99CXAHh-FXi_ZkIKD8hK6FrAs68qhLf8MNkUv63DTduw7QgeFfQivdopePxyGuMk5n8veqwsUZsklQkhNlTYQqeM1xb2698ZQcNYkl0OssEsSJKRjXt-LRPowKrdvTuTo2p--HMI0pIEeFs7H_u5OW3jihjvoFClGPynHQhgWmQzlQRvWRXh6FhDVqFeGQ", "n": "zfZzttF7HmnTYwSMPdxKs5AoczbNS2mOPz-tN1g4ljqI_F1DG8cgQDcN_VDufxoFGRERo2FK6WEN41LhbGEyP6uL6wW6Cy29qE9QZcvY5mXrncndRSOkNcMizvuEJes_fMYrmP_lPiC6kWiqItTk9QBWqJfiYKhCx9cSDXsBmJXn3KWQCVHvj1ANFWW0CWLMKlWN-_NMNLIWJN_pEAocTZMzxSFBK1b5_5J8ZS7hfWRF6MQmjsJcz2jzA21SQZNpre3kwnTGRSwo05sAS-TyeadDqQPWgbqX69UzcGq5irhzN8cpZ_JaTk3Y_uV6owanTZLVvCgdjaAnMYeZhb0KFw", "q": "5E5XKK5njT-zzRqqTeY2tgP9PJBACeaH_xQRHZ_1ydE7tVd7HdgdaEHfQ1jvKIHFkknWWOBAY1mlBc4YDirLShB_voShD8C-Hx3nF5sne5fleVfU-sZy6Za4B2U75PcE62oZgCPauOTAEm9Xuvrt5aMMovyzR8ecJZhm9bw7naU", "p": "5vJHCSM3H3q4RltYzENC9RyZZV8EUmpkv9moyguT5t-BUGA-T4W_FGIxzOPXRWOckIplKkoDKhavUeNmTZMCUcue0nkICSJpvNE4Nb2p5PZk_QqSdQNvCasQtdojEG0AmfVD85SU551CYxJdLdDFOqyK2entpMr8lhokem189As", "kid": "a1", "kty": "RSA"}, {"d": "lwn2-SAof8mOglL5cdNTQzVjU137yO7084ypMu4p0EQ", "use": "sig", "crv": "P-256", "kty": "EC", "y": "VxyJGVe3mmsPyms7ugq0HYZZh59e_jbkoRQDO2WgK4A", "x": "hx0vhzyKhRD48YI3V4ubWRADPlP1IlOoxCv8_TQ-D60", "kid": "a2"}, {"d": "djyMlJezYcC14cARXqUKxe-k-b1zazokR_ZKjFqzwOg", "use": "enc", "crv": "P-256", "kty": "EC", "y": "aXj0IQrd8HlweOyNUSE4W7HTTR5YhQAJysyRmoRfC-E", "x": "DNqmM0uMuP88mCe2MjInTOrGeEkd0FbPFN7_os21EIg", "kid": "a3"}]}, "application_type": "web", "contacts": ["roland.hedberg@umu.se"], "post_logout_redirect_uris": ["https://op.certification.openid.net:60194/logout"], "redirect_uris": ["https://op.certification.openid.net:60194/authz_cb", "https://op.certification.openid.net:60194/cb", "https://op.certification.openid.net:60194/cb", "https://op.certification.openid.net:60194/cb", "https://op.certification.openid.net:60194/cb"], "response_types": ["code id_token token"], "require_auth_time": true, "grant_types": ["authorization_code", "implicit"], "default_max_age": 3600}
0.660654 --> HEADERS: {'Content-Type': 'application/json'}
"jwks_uri": null, "jwks": {"keys": [{"use ...

While both claims are OPTIONAL under jwks_uri the spec says

The jwks_uri and jwks parameters MUST NOT be used together.

I believe the right approach would be to remove the jwks_uri property from the payload altogether instead of just setting it to None and therefore after JSON serialization it ending up being null.