[
https://issues.apache.org/jira/browse/SYNCOPE-2004?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Francesco Chicchiriccò updated SYNCOPE-2004:
--------------------------------------------
Fix Version/s: 4.0.10
4.1.5
4.2.0
(was: 4.0.9)
(was: 4.1.4)
Affects Version/s: (was: 5.0.0)
> OIDC C4UI back-channel logout fails during logout token validation
> ------------------------------------------------------------------
>
> Key: SYNCOPE-2004
> URL: https://issues.apache.org/jira/browse/SYNCOPE-2004
> Project: Syncope
> Issue Type: Bug
> Components: core
> Affects Versions: 4.0.9, 4.1.4
> Reporter: Matteo Tatoni
> Assignee: Matteo Tatoni
> Priority: Critical
> Labels: security
> Fix For: 4.0.10, 4.1.5, 4.2.0, 5.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> When the OpenID Provider sends a back-channel logout request, Syncope
> throws the following exception:
>
> {code:java}
> NullPointerException: Cannot invoke
> "org.pac4j.oidc.profile.creator.TokenValidator.validateLogoutToken(com.nimbusds.jwt.JWT)"
> because the return value of
> "org.pac4j.oidc.metadata.OidcOpMetadataResolver.getTokenValidator()" is
> null.{code}
> The exception prevents Syncope from revoking the associated access token.
> *Steps to reproduce:*
> 1. Configure OIDC authentication for the Syncope Console using Syncope WA as
> the OpenID Provider, with back-channel logout enabled.
> 2. Sign in to the Console through OIDC with a regular user.
> 3. In another tab of the same browser, open the WA logout
> endpoint:<WA_BASE_URL>/logout.
> 4. Return to the Console and perform an action that triggers a request to
> Core.
> Back-channel logout fails with a NullPointerException during logout token
> validation. The access token remains valid, and the user can continue using
> the Console.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
