[
https://issues.apache.org/jira/browse/SYNCOPE-2004?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136391#comment-18136391
]
ASF subversion and git services commented on SYNCOPE-2004:
----------------------------------------------------------
Commit dc7cfae33df32b5282a8f8b3d740bbdfc28286d1 in syncope's branch
refs/heads/master from Matteo Tatoni
[ https://gitbox.apache.org/repos/asf?p=syncope.git;h=dc7cfae33d ]
[SYNCOPE-2004] - Fix OIDCC4UI back-channel logout token validator
initialization (#1594)
> OIDC C4UI back-channel logout fails during logout token validation
> ------------------------------------------------------------------
>
> Key: SYNCOPE-2004
> URL: https://issues.apache.org/jira/browse/SYNCOPE-2004
> Project: Syncope
> Issue Type: Bug
> Components: core
> Affects Versions: 4.0.9, 4.1.4
> Reporter: Matteo Tatoni
> Assignee: Matteo Tatoni
> Priority: Critical
> Labels: security
> Fix For: 4.0.10, 4.1.5, 4.2.0, 5.0.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> When the OpenID Provider sends a back-channel logout request, Syncope
> throws the following exception:
>
> {code:java}
> NullPointerException: Cannot invoke
> "org.pac4j.oidc.profile.creator.TokenValidator.validateLogoutToken(com.nimbusds.jwt.JWT)"
> because the return value of
> "org.pac4j.oidc.metadata.OidcOpMetadataResolver.getTokenValidator()" is
> null.{code}
> The exception prevents Syncope from revoking the associated access token.
> *Steps to reproduce:*
> 1. Configure OIDC authentication for the Syncope Console using Syncope WA as
> the OpenID Provider, with back-channel logout enabled.
> 2. Sign in to the Console through OIDC with a regular user.
> 3. In another tab of the same browser, open the WA logout
> endpoint:<WA_BASE_URL>/logout.
> 4. Return to the Console and perform an action that triggers a request to
> Core.
> Back-channel logout fails with a NullPointerException during logout token
> validation. The access token remains valid, and the user can continue using
> the Console.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
