[
https://issues.apache.org/jira/browse/SYNCOPE-2004?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Matteo Tatoni updated SYNCOPE-2004:
-----------------------------------
Description:
When the OpenID Provider sends a back-channel logout request, Syncope
throws the following exception:
{code:java}
NullPointerException: Cannot invoke
"org.pac4j.oidc.profile.creator.TokenValidator.validateLogoutToken(com.nimbusds.jwt.JWT)"
because the return value of
"org.pac4j.oidc.metadata.OidcOpMetadataResolver.getTokenValidator()" is
null.{code}
The exception prevents Syncope from revoking the associated access token.
*Steps to reproduce:*
1. Configure OIDC authentication for the Syncope Console using Syncope WA as
the OpenID Provider, with back-channel logout enabled.
2. Sign in to the Console through OIDC with a regular user.
3. In another tab of the same browser, open the WA logout
endpoint:<WA_BASE_URL>/logout.
4. Return to the Console and perform an action that triggers a request to Core.
Back-channel logout fails with a NullPointerException during logout token
validation. The access token remains valid, and the user can continue using the
Console.
was:
When the OpenID Provider sends a back-channel logout request, Syncope
throws the following exception:
{code:java}
NullPointerException: Cannot invoke
"org.pac4j.oidc.profile.creator.TokenValidator.validateLogoutToken(com.nimbusds.jwt.JWT)"
because the return value of
"org.pac4j.oidc.metadata.OidcOpMetadataResolver.getTokenValidator()" is
null.{code}
The exception prevents Syncope from revoking the associated access token.
Steps to reproduce:
1. Configure OIDC authentication for the Syncope Console using Syncope WA as
the OpenID Provider, with back-channel logout enabled.
2. Sign in to the Console through OIDC with a regular user.
3. In another tab of the same browser, open the WA logout
endpoint:<WA_BASE_URL>/logout.
4. Return to the Console and perform an action that triggers a request to Core.
Back-channel logout fails with a NullPointerException during logout token
validation. The access token remains valid, and the user can continue using the
Console.
> OIDC C4UI back-channel logout fails during logout token validation
> ------------------------------------------------------------------
>
> Key: SYNCOPE-2004
> URL: https://issues.apache.org/jira/browse/SYNCOPE-2004
> Project: Syncope
> Issue Type: Bug
> Components: core
> Affects Versions: 4.0.9, 4.1.4, 5.0.0
> Reporter: Matteo Tatoni
> Assignee: Matteo Tatoni
> Priority: Critical
> Labels: security
> Fix For: 4.0.9, 4.1.4, 5.0.0
>
>
> When the OpenID Provider sends a back-channel logout request, Syncope
> throws the following exception:
>
> {code:java}
> NullPointerException: Cannot invoke
> "org.pac4j.oidc.profile.creator.TokenValidator.validateLogoutToken(com.nimbusds.jwt.JWT)"
> because the return value of
> "org.pac4j.oidc.metadata.OidcOpMetadataResolver.getTokenValidator()" is
> null.{code}
> The exception prevents Syncope from revoking the associated access token.
> *Steps to reproduce:*
> 1. Configure OIDC authentication for the Syncope Console using Syncope WA as
> the OpenID Provider, with back-channel logout enabled.
> 2. Sign in to the Console through OIDC with a regular user.
> 3. In another tab of the same browser, open the WA logout
> endpoint:<WA_BASE_URL>/logout.
> 4. Return to the Console and perform an action that triggers a request to
> Core.
> Back-channel logout fails with a NullPointerException during logout token
> validation. The access token remains valid, and the user can continue using
> the Console.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
