Session manager dump, missing values

[peppelinux]

Hi there,
The following is a dump of a session, the elements in bold should catch our attention

{
"expires_at": 1620989852,
"issued_at": 1620946652,
"not_before": 0,
"revoked": false,
"usage_rules": {
"authorization_code": {
"supports_minting": [
"access_token",
"refresh_token",
"id_token"
],
"max_usage": 1
},
"access_token": {},
"refresh_token": {
"supports_minting": [
"access_token",
"refresh_token"
]
}
},
"used": 2,
"authentication_event": {
"oidcop.authn_event.AuthnEvent": {
"uid": "wert",
"authn_info": "oidcop.user_authn.authn_context.INTERNETPROTOCOLPASSWORD",
"authn_time": 1620946652,
"valid_until": 1620950252
}
},
"authorization_request": {
"oidcmsg.oidc.AuthorizationRequest": {
"redirect_uri": "https://{domain}:{port}/authz_cb/django",
"scope": "openid profile email address phone",
"response_type": "code",
"nonce": "f5rAJZdZ5zOpMv1wSzL7qFOO",
"state": "pEoiWGl4BG7WrvYyK34JhV6BoMJtlnQ9",
"code_challenge": "PsfTtRje76sGk4muOhnXD1rjI10fNKwYNLgsLcawgrw",
"code_challenge_method": "S256",
"client_id": "VjIX06LEI6MCrlRL-m6Hvg"
}
},
"claims": {
"userinfo": {
"sub": null,
"name": null,
"given_name": null,
"family_name": null,
"middle_name": null,
"nickname": null,
"profile": null,
"picture": null,
"website": null,
"gender": null,
"birthdate": null,
"zoneinfo": null,
"locale": null,
"updated_at": null,
"preferred_username": null
},
"introspection": {},
"id_token": {
"email": null,
"email_verified": null
},
"access_token": {}
},
"resources": [
"VjIX06LEI6MCrlRL-m6Hvg"
],
"scope": [
"openid",
"profile",
"email",
"address",
"phone"
],
"sub": "1a4962cd184469545b6149f35485b407ccb21a8a311ed78f5374171cb1d66b2c",
"issued_token": [
{
"oidcop.session.token.AuthorizationCode": {
"expires_at": 0,
"issued_at": 1620946652,
"not_before": 0,
"revoked": false,
"usage_rules": {
"supports_minting": [
"access_token",
"refresh_token",
"id_token"
],
"max_usage": 1
},
"used": 1,
"claims": {},
"id": "99dc24e5b43e11ebb4d08b3ca714a137",
"name": "AuthorizationCode",
"resources": [],
"scope": [], <-- Why is this empty?
"type": "authorization_code",
"value": "Z0FBQUFBQmduYTdjdTBSbno2eVJMUFNxdGZhOG1fRVFKNU9iVE9Ea1JBZ2hxQVdFanBIN0YwbXE3YUJsUnhIRlVvSkoxYi1hN1pld0VYV3JBRzB1dlF4cm5pZFVYdHhuSXo5QTNBY09ZMk5HNEwyWnloM19LOXZsUkNQZ1hYTHV6bm93c3dFWlgzdmZ4cDBPX2luUnFzenZTU2lBM3NhWENyd1R0RzFFbmoyLVQzRXNhV2FUYzFTbXRzM0hMM2FnajRFLW1DeU5SUmk5T0xCWFdISjV2bkl5WmI2UFpRNmRSNkZlYWZxRTg4cjZleHJxTldQbng2RlVMOXVVMUNwSnd3cDRnTDlTSkY5ZE56MWtiNDBreTlsbnliZkR4ZGh2LXMyRDcwdnpsNnpxQjRlNkl6WmUxZTNnbmVabTlMQ3d1MEpZcXQtRFFCU1lYNWVPc3UwWHczX3ExQkVFUGdFTkkwXzhqSDdIbGhXRWp5YkRRMC16bUg1LWRiZUxwWmxRd0xRLV9NU0Jqa1hITzEwbVBRalpFdDFQS1EtaXVqSlFBTjMtS2tidl9QRTBGZnJreFBYTXBiVFVldVJWVmZkN181Wm9PcDZQalJvOXg4Q3JVZzlHRG90YkstM3RKdWVoSnlkeHNSUHFQUVNfdTQzcmotUkVVbWJReUtOVDZRQmR3RE1hSTJxLUtJRFhZZV9DaDYwTUZHU2ZpUlZHcFFEQ2RKb2wxQXYyQjVkRTQ4VFh0dWVaZFNoLXo0cU5BaGJjSVNycEFnOTlJQXFETmFQS3NTUlBIQ0lNRkl1Ulg5dERZUEJhaDFmX2lwem9UMGRQaFR3SzJEYz0="
}
},
{
"oidcop.session.token.AccessToken": {
"expires_at": 0,
"issued_at": 1620946652,
"not_before": 0,
"revoked": false,
"usage_rules": {},
"used": 0,
"based_on": "Z0FBQUFBQmduYTdjdTBSbno2eVJMUFNxdGZhOG1fRVFKNU9iVE9Ea1JBZ2hxQVdFanBIN0YwbXE3YUJsUnhIRlVvSkoxYi1hN1pld0VYV3JBRzB1dlF4cm5pZFVYdHhuSXo5QTNBY09ZMk5HNEwyWnloM19LOXZsUkNQZ1hYTHV6bm93c3dFWlgzdmZ4cDBPX2luUnFzenZTU2lBM3NhWENyd1R0RzFFbmoyLVQzRXNhV2FUYzFTbXRzM0hMM2FnajRFLW1DeU5SUmk5T0xCWFdISjV2bkl5WmI2UFpRNmRSNkZlYWZxRTg4cjZleHJxTldQbng2RlVMOXVVMUNwSnd3cDRnTDlTSkY5ZE56MWtiNDBreTlsbnliZkR4ZGh2LXMyRDcwdnpsNnpxQjRlNkl6WmUxZTNnbmVabTlMQ3d1MEpZcXQtRFFCU1lYNWVPc3UwWHczX3ExQkVFUGdFTkkwXzhqSDdIbGhXRWp5YkRRMC16bUg1LWRiZUxwWmxRd0xRLV9NU0Jqa1hITzEwbVBRalpFdDFQS1EtaXVqSlFBTjMtS2tidl9QRTBGZnJreFBYTXBiVFVldVJWVmZkN181Wm9PcDZQalJvOXg4Q3JVZzlHRG90YkstM3RKdWVoSnlkeHNSUHFQUVNfdTQzcmotUkVVbWJReUtOVDZRQmR3RE1hSTJxLUtJRFhZZV9DaDYwTUZHU2ZpUlZHcFFEQ2RKb2wxQXYyQjVkRTQ4VFh0dWVaZFNoLXo0cU5BaGJjSVNycEFnOTlJQXFETmFQS3NTUlBIQ0lNRkl1Ulg5dERZUEJhaDFmX2lwem9UMGRQaFR3SzJEYz0=",
"claims": {},
"id": "99dc24eab43e11ebb4d08b3ca714a137",
"name": "AccessToken",
"resources": [],
"scope": [], <-- Why is this empty?
"type": "access_token",
"value": "eyJhbGciOiJFUzI1NiIsImtpZCI6ImNqRTBka3RWVDFwa2F6Wk9lVkowTFVsd1RXTkVjVVZvTFZveVdXTXhaMFpQTkZGR1ZuYzNkWEZOY3cifQ.eyJzY29wZSI6IFsib3BlbmlkIiwgInByb2ZpbGUiLCAiZW1haWwiLCAiYWRkcmVzcyIsICJwaG9uZSJdLCAiYXVkIjogWyJWaklYMDZMRUk2TUNybFJMLW02SHZnIl0sICJzaWQiOiAiWjBGQlFVRkJRbWR1WVRkamNUWTBhakEyVVhwcVFXZ3hZamxXZURJeFdIcEdhbkl6TkRkTU5YcERWVGRMVTBoUFJUTnRSMUp6TVhjeVRucFhSRlZpYmpOa01FTlJNM0ptTVhFdGJWQlZaa3RxTWpNMVVFRXhjV2xZYTBkUlpXOVBPV0ZyUmpZd05WVmFSams0YTNoeVgxVmxiRWd3V1ZCWGRUazJWblJXUkZKa2JrRmljVkJhTjBWTmVIVm9jVEkyT0hKYWNUZE1lRXRTV2s5U1gyOVBTVEJNVm5JNVZ6UmZibXBMTldVNVUydFNSMDFvWjFaMFMwTk9Ra3BhV1ZGeU4xOUtMV2xNVVVoUlpXOUJNSFYyZDBGUVduSnBjR3ByZW1NelYyaDFOSHBPV1RkVlRERTNNVGhXVFc5MVRVcEhUak50VFhsR2F6MD0iLCAidHR5cGUiOiAiVCIsICJpc3MiOiAiaHR0cHM6Ly8xMjcuMC4wLjE6ODAwMCIsICJpYXQiOiAxNjIwOTQ2NjUyLCAiZXhwIjogMTYyMDk1MDI1Mn0.kpi633NTS4SUf7fwCF0gGHphz-qwzF_BorKiqxcaBsya3sz_hEjsHmRPmIRI3JKmHL143XQ--wIhFlkd8tElqQ"
}
}
],
"token_map": {
"authorization_code": "oidcop.session.token.AuthorizationCode",
"access_token": "oidcop.session.token.AccessToken",
"refresh_token": "oidcop.session.token.RefreshToken"
}
}

[rohe]

Can't say. I'll deal with this when I'm done with ID Token being a session token.

[rohe]

I think it's about which authz handler you are using.
If you are using oidcop.authz.Implicit which was the default up to a while ago then this would be the expected behaviour.
If you are using oidcop.authz.AuthzHandling this is not would you would expect.
So, which one are you using ?

[peppelinux]

OIDC_OP_AUTHZ = {
    "class": "oidcop.authz.AuthzHandling",
    "kwargs": {
        "grant_config": {
            "usage_rules": {
                "authorization_code": {
                    "supports_minting": ["access_token", "refresh_token", "id_token"],
                    "max_usage": 1
                },
                "access_token": {},
                "refresh_token": {
                    "supports_minting": ["access_token", "refresh_token"]
                }
            },
            "expires_in": 43200
        }
    }
}

[peppelinux]

Correct me if I'm wrong, we need that a minted token have the scope for which was issued (even if scope claim is not available in the token itself)

that's needed for introspection

a authz request happens with 4 scopes, but the grant have been issued only for two of them. We need this information.
So, do I miss something?

[rohe]

The allowed scopes may be none that is equal to []. How that would be interpreted by the resource server I have no idea.
The allowed scopes MUST be in the session token that are stored in the grant under issued_tokens and it might also
be present in the token itself (if it's a JWT token).
If that is your authz configuration then I don't understand how you get scope = [].
Given the authorization request that was issued you should have scope = ["openid", "profile", "email", "address", "phone"]
I'll have to investigate further.

[peppelinux]

Try to have an authz request with many scopes and an OP that issues only some of them, we should have only those issued in the token scopes

[rohe]

I've found a problem. In the process of fixing it now.

[rohe]

Hmm, not sure it was a problem.

The thing is there are two places where you want the scopes to be visible.
The first one is in the token itself (if it's a JWT token)
The second is at the introspection endpoint.

Regarding the first one the payload_arguments method makes sure the correct information is in the token.

Regarding the second the logic of the code is that if there is no scope defined in the session token (NOTE: the instance that is stored in issued_tokens) then whatever is in the grant instance is what is used.
So in your example, there is no scope in the session token but that is OK since there is one in the grant instance and that one is used then as the scope for the token.

There might be a problem here because you really want the sequence of issued tokens to be evaluated.
Like access_token -base_on-> refresh_token -based_on-> refresh_token -> grant
I have to fix that.

[peppelinux]

Hi Roland, It seems that's the only pending issue, then we'll have the v2.0.0 release finally done 😀