From acfccd84ba8ea40f0bd3f431b39d8aff8a262d45 Mon Sep 17 00:00:00 2001
From: Yadd <yadd@debian.org>
Date: Mon, 6 Feb 2023 07:38:07 +0400
Subject: [PATCH 1/3] Include sid in OIDC tokens (#2862)

---
 .../NG/Portal/Issuer/OpenIDConnect.pm         |  1 +
 .../Lemonldap/NG/Portal/Lib/OpenIDConnect.pm  | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
index 600e31a08d..7942ad7ea8 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
@@ -2488,6 +2488,7 @@ sub _generateIDToken {
         acr       => $id_token_acr,  # Authentication Context Class Reference
         azp       => $client_id,     # Authorized party, this is used for logout
                                      # TODO amr
+        sid       => $self->getSidFromSession( $rp, $sessionInfo ), # Session id
     };
 
     for ( keys %{$extra_claims} ) {
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
index b995dadf36..ff8d1149e9 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
@@ -1115,6 +1115,7 @@ sub makeJWT {
         iat       => time,                        # Issued time
         jti       => $id,                         # Access Token session ID
         scope     => $scope,                      # Scope
+        sid       => $self->getSidFromSession( $rp, $sessionInfo ), # Session id
     };
 
     my $claims =
@@ -2432,6 +2433,26 @@ sub generateNonce {
     return encode_base64url( Crypt::URandom::urandom(16) );
 }
 
+sub getSidFromSession {
+    my ( $self, $rp, $sessionInfo ) = @_;
+    return $self->conf->{cipher}
+      ->encrypt( $sessionInfo->{_session_id} . ':' . $rp );
+}
+
+sub getSessionIdFromSid {
+    my ( $self, $sid, $rp ) = @_;
+    my $str = $self->conf->{cipher}->decrypt($sid);
+    unless ( $str and $str =~ /^(?<id>.*?):(?<rp>.*)$/ ) {
+        $self->logger->error("Invalid sid: $sid");
+        return undef;
+    }
+    if ( $rp and $rp ne $+{rp} ) {
+        $self->logger->error( "RP id mismatch in sid: $rp != " . $+{rp} );
+        return undef;
+    }
+    return $+{id};
+}
+
 1;
 
 __END__
-- 
GitLab


From 7b84674e5e986087aff6ddef74ebc46632e09fd5 Mon Sep 17 00:00:00 2001
From: Yadd <yadd@debian.org>
Date: Mon, 6 Feb 2023 07:45:20 +0400
Subject: [PATCH 2/3] OIDC: use valid sid in Front-Channel (#2863)

---
 .../lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
index 7942ad7ea8..820c533639 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
@@ -2187,12 +2187,12 @@ sub logout {
                 if ( $rpConf->{oidcRPMetaDataOptionsLogoutType} eq 'front' ) {
                     if ( $rpConf->{oidcRPMetaDataOptionsLogoutSessionRequired} )
                     {
-                        my $user_id = $self->getUserIDForRP( $req, $rp,
-                            $req->{sessionInfo} );
                         $url .= ( $url =~ /\?/ ? '&' : '?' )
                           . build_urlencoded(
                             iss => $self->iss,
-                            sid => $user_id
+                            sid => $self->getSidFromSession(
+                                $rp, $req->{sessionInfo}
+                            )
                           );
                     }
                     $req->info( qq'<iframe src="$url" class="noborder">'
-- 
GitLab


From aac71dc4ff8eab17bb0b5db00fd0d3ed6382d6c7 Mon Sep 17 00:00:00 2001
From: Yadd <yadd@debian.org>
Date: Mon, 6 Feb 2023 08:10:44 +0400
Subject: [PATCH 3/3] Improve `sid` integration (#2862)

---
 .../lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm        | 7 +++----
 .../lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm           | 3 ++-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
index 820c533639..2f7b972521 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
@@ -2309,7 +2309,7 @@ sub metadata {
               [qw/client_secret_post client_secret_basic/],
             introspection_endpoint_auth_methods_supported =>
               [qw/client_secret_post client_secret_basic/],
-            claims_supported                 => [qw/sub iss auth_time acr/],
+            claims_supported                 => [qw/sub iss auth_time acr sid/],
             request_parameter_supported      => JSON::true,
             request_uri_parameter_supported  => JSON::true,
             require_request_uri_registration => JSON::false,
@@ -2338,7 +2338,6 @@ sub metadata {
     # token_endpoint_auth_signing_alg_values_supported
     # display_values_supported
     # claim_types_supported
-    # RECOMMENDED # claims_supported
     # service_documentation
     # claims_locales_supported
     # ui_locales_supported
@@ -2493,7 +2492,7 @@ sub _generateIDToken {
 
     for ( keys %{$extra_claims} ) {
         $id_token_payload_hash->{$_} = $extra_claims->{$_}
-          if $extra_claims->{$_};
+          if $extra_claims->{$_} and not $id_token_payload_hash->{$_};
     }
 
     # Decided by response_type or forced in RP config
@@ -2505,7 +2504,7 @@ sub _generateIDToken {
 
         foreach ( keys %$claims ) {
             $id_token_payload_hash->{$_} = $claims->{$_}
-              unless ( $_ eq "sub" );
+              unless ( $_ eq "sub" or $_ eq "sid" );
         }
     }
 
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
index ff8d1149e9..eab8e2881c 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
@@ -1126,7 +1126,8 @@ sub makeJWT {
         ->{oidcRPMetaDataOptionsAccessTokenClaims} )
     {
         foreach ( keys %$claims ) {
-            $access_token_payload->{$_} = $claims->{$_};
+            $access_token_payload->{$_} = $claims->{$_}
+              unless $access_token_payload->{$_};
         }
     }
     else {
-- 
GitLab