disallow client secret authentication in HEART mode

Author: jricher

openid-connect-common/src/main/java/org/mitre/oauth2/service/impl/DefaultClientUserDetailsService.java

@@ -24,6 +24,7 @@
 import org.mitre.oauth2.model.ClientDetailsEntity;
 import org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod;
 import org.mitre.oauth2.service.ClientDetailsEntityService;
+import org.mitre.openid.connect.config.ConfigurationPropertiesBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -50,6 +51,9 @@ public class DefaultClientUserDetailsService implements UserDetailsService {
 @Autowired
 private ClientDetailsEntityService clientDetailsService;
 
+@Autowired
+private ConfigurationPropertiesBean config;
+
 @Override
 public UserDetails loadUserByUsername(String clientId) throws UsernameNotFoundException {
 
@@ -60,9 +64,10 @@ public UserDetails loadUserByUsername(String clientId) throws UsernameNotFoundE
 
 String password = Strings.nullToEmpty(client.getClientSecret());
 
-if (client.getTokenEndpointAuthMethod() != null &&
-(client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) ||
-client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT))) {
+if (config.isHeartMode() || // if we're running HEART mode turn off all client secrets
+(client.getTokenEndpointAuthMethod() != null &&
+(client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) ||
+client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT)))) {
 
 // Issue a random password each time to prevent password auth from being used (or skipped)
 // for private key or shared key clients, see #715

openid-connect-common/src/main/java/org/mitre/oauth2/service/impl/UriEncodedClientUserDetailsService.java

@@ -25,6 +25,7 @@
 import org.mitre.oauth2.model.ClientDetailsEntity;
 import org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod;
 import org.mitre.oauth2.service.ClientDetailsEntityService;
+import org.mitre.openid.connect.config.ConfigurationPropertiesBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -54,6 +55,9 @@ public class UriEncodedClientUserDetailsService implements UserDetailsService {
 @Autowired
 private ClientDetailsEntityService clientDetailsService;
 
+@Autowired
+private ConfigurationPropertiesBean config;
+
 @Override
 public UserDetails loadUserByUsername(String clientId) throws UsernameNotFoundException {
 
@@ -66,9 +70,10 @@ public UserDetails loadUserByUsername(String clientId) throws UsernameNotFoundE
 
 String encodedPassword = UriUtils.encodeQueryParam(Strings.nullToEmpty(client.getClientSecret()), "UTF-8");
 
-if (client.getTokenEndpointAuthMethod() != null &&
-(client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) ||
-client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT))) {
+if (config.isHeartMode() || // if we're running HEART mode turn off all client secrets
+(client.getTokenEndpointAuthMethod() != null &&
+(client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY) ||
+client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT)))) {
 
 // Issue a random password each time to prevent password auth from being used (or skipped)
 // for private key or shared key clients, see #715