[
https://issues.apache.org/jira/browse/CXF-8413?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17271911#comment-17271911
]
Colm O hEigeartaigh edited comment on CXF-8413 at 1/26/21, 8:04 AM:
--------------------------------------------------------------------
You need to add a
[https://github.com/apache/cxf/blob/511907ef4f6d8ac4c4acb9b988c6389e0880dd7e/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenResponseFilter.java]
which in turn is composed with:
[https://github.com/apache/cxf/blob/511907ef4f6d8ac4c4acb9b988c6389e0880dd7e/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenProvider.java]
For example in the systests:
[https://github.com/apache/cxf/blob/a3a49c7ee82f83bc683b898594d5c4948578f25a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oidc/oidc-server-jcache.xml#L75]
I've updated the wiki to make it a bit clearer.
was (Author: coheigea):
You need to add a
[https://github.com/apache/cxf/blob/511907ef4f6d8ac4c4acb9b988c6389e0880dd7e/rt/rs/security/sso/oidc/src/main/java/org/apache/cxf/rs/security/oidc/idp/IdTokenProvider.java]
implementation to OidcImplicitService / OidcHybridService to return IdToken.
For example in the systests:
[https://github.com/apache/cxf/blob/a3a49c7ee82f83bc683b898594d5c4948578f25a/systests/rs-security/src/test/resources/org/apache/cxf/systest/jaxrs/security/oidc/oidc-server-jcache.xml#L76]
> OIDC Implicit Flow: id_token not returned if other response types are included
> ------------------------------------------------------------------------------
>
> Key: CXF-8413
> URL: https://issues.apache.org/jira/browse/CXF-8413
> Project: CXF
> Issue Type: Bug
> Components: JAX-RS Security
> Affects Versions: 3.4.2
> Reporter: Will Croteau
> Assignee: Colm O hEigeartaigh
> Priority: Major
> Labels: OIDC
>
> Per the [OIDC
> Specification|https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#Combinations]:
> {quote}id_token token
> When supplied as the value for the response_type parameter, a successful
> response MUST include an Access Token, an Access Token Type, and an id_token.
> The default Response Mode for this Response Type is the fragment encoding and
> the query encoding MUST NOT be used. Both successful and error responses
> SHOULD be returned using the supplied Response Mode, or if none is supplied,
> using the default Response Mode.
> {quote}
> OidcImplicitService and OidcHybridService do not include the id_token in the
> response if token is also requested.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
