Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

All work

Go to all work items
Select view

Select search mode

 
50 of 120

Transcoding of object type of claim fails

Description

OIDC RP uses transcoder to decode received claims before storing them to subject. This fails if the incoming claims is of type Object. OIDCStringAttributeTranscoder class expects such claims to be of type ‘net.minidev.json.JSONObject’ but they actually are of type 'com.nimbusds.jose.shaded.gson.internal.LinkedTreeMap'. As a result claim is silently lost in transcoding process and never stored to Subject even if having a transcoder of presumably correct type.

Environment

None

Details

Assignee

Reporter

Components

Created March 28, 2025 at 10:13 AM
Updated April 4, 2025 at 4:22 PM

Activity

Show:

Philip SmartApril 4, 2025 at 4:22 PM

Technically, this could be solved in the RP for now, as that controls the claim going into the Transcoder.

Philip SmartApril 4, 2025 at 4:06 PM
Edited

Speaking to Scott, it might be OK for a patch to convert the LinkedTreeMapinto the expected JSONObject before it hits the transcoder.

Also, I’ll speak to @Henri about testing this from his real OP instance.

Scott CantorMarch 31, 2025 at 12:27 PM

Certainly in the bigger picture, having a dedicated API to wrap and expose JSON messages is the closest analog to what was done for SAML, and the Transcoding layer was definitely designed around that idea.

One way around it might be to instantuate a delegating object implementing a dedicated marker interface and be able to get at the different representations we have to accomodate in the different cases, so the Transcoders would operate on that marler type but get at the guts via a separate method internally.

Then the transcoders would know for certain they were given an object intentionally to process.

Philip SmartMarch 28, 2025 at 4:37 PM

This was not easy to test because the the OIDCStringAttributeTranscoderencodedType is a JSONObject. So, I did not go through the usual TranscoderRegistry and instead called the decodeValues method of the OIDCStringAttributeTranscoder directly with the LinkedTreeMap.

I think the best option here with the least change would be to add an if clause that tests for a Map and serialises that Map to a JSON string value (just as it does for a JSON Object).

Philip SmartMarch 28, 2025 at 11:54 AM

Yes, the decode method does not understand that type, as you say. Both are java.util.Maps. I’ll take a look.

jlauros@csc.fiMarch 28, 2025 at 12:31 PM

Map makes sense. Maybe that is the answer for it then.

Flag notifications