Matteo Tatoni created SYNCOPE-2004:
--------------------------------------
Summary: OIDC C4UI back-channel logout fails during logout token
validation
Key: SYNCOPE-2004
URL: https://issues.apache.org/jira/browse/SYNCOPE-2004
Project: Syncope
Issue Type: Bug
Components: core
Affects Versions: 4.0.9, 4.1.4, 5.0.0
Reporter: Matteo Tatoni
Assignee: Matteo Tatoni
Fix For: 4.0.9, 4.1.4, 5.0.0
When the OpenID Provider sends a back-channel logout request, Syncope
throws the following exception:
{code:java}
NullPointerException: Cannot invoke
"org.pac4j.oidc.profile.creator.TokenValidator.validateLogoutToken(com.nimbusds.jwt.JWT)"
because the return value of
"org.pac4j.oidc.metadata.OidcOpMetadataResolver.getTokenValidator()" is
null.{code}
The exception prevents Syncope from revoking the associated access token.
Steps to reproduce:
1. Configure OIDC authentication for the Syncope Console using Syncope WA as
the OpenID Provider, with back-channel logout enabled.
2. Sign in to the Console through OIDC with a regular user.
3. In another tab of the same browser, open the WA logout
endpoint:<WA_BASE_URL>/logout.
4. Return to the Console and perform an action that triggers a request to Core.
Back-channel logout fails with a NullPointerException during logout token
validation. The access token remains valid, and the user can continue using the
Console.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
