habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

providers/oauth2: use # as separate for code#adfs, check if # exists in response_type and trim

Browse Source
This commit is contained in:
Jens Langhammer
2020-09-19 18:33:22 +02:00
parent c1ea605c7e
commit a02fcb0a7a
3 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
passbook/providers/oauth2/views/authorize.py
View File

@ -163,8 +163,15 @@ class OAuthAuthorizationParams:
raise AuthorizeError(self.redirect_uri, "invalid_request", self.grant_type)
# Response type parameter validation.
if is_open_id and self.response_type != self.provider.response_type:
raise AuthorizeError(self.redirect_uri, "invalid_request", self.grant_type)
if is_open_id:
actual_response_type = self.provider.response_type
if "#" in self.provider.response_type:
hash_index = actual_response_type.index("#")
actual_response_type = actual_response_type[:hash_index]
if self.response_type != actual_response_type:
raise AuthorizeError(
self.redirect_uri, "invalid_request", self.grant_type
)
# PKCE validation of the transformation method.
if self.code_challenge: