feat(jans-auth-server): added jti and client_id to userinfo #8763

[yuriyz]

Description

feat(jans-auth-server): added jti and client_id to userinfo

Target issue

closes #8763

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

Closes #8922,

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the security and functionality of the User Info endpoint in the Jans Auth Server application by implementing a new UserInfoService class, modifying the UserInfoRestWebServiceImpl class, adding documentation, and implementing unit tests.

Expand for full summary

Summary:

The code changes in this pull request are focused on improving the security and functionality of the User Info endpoint in the Jans Auth Server application. The changes include:

1. Implementing a new UserInfoService class to handle the population of the JsonWebResponse object with necessary claims, such as the JSON Web Token ID (jti) and the client ID (client_id). This helps ensure the integrity and traceability of the user information being returned.

2. Modifying the UserInfoRestWebServiceImpl class to use the new UserInfoService and to perform thorough validation of the access token and authorization grant before processing the user information request. This helps prevent unauthorized access to user data.

3. Adding documentation for the User Info endpoint, which explicitly states the required claims in the response, including sub, jti, and client_id. This promotes consistency and clarity in the API.

4. Implementing unit tests for the UserInfoService class to ensure the correct handling of the required claims in the JsonWebResponse object. This helps maintain the security and reliability of the user information handling process.

From an application security perspective, these changes are generally positive and do not introduce any obvious security concerns. However, it is important to continue to monitor the security of the User Info endpoint and ensure that it is properly secured, including:

• Implementing robust access control mechanisms to restrict access to authorized parties
• Thoroughly validating all input parameters to prevent injection attacks
• Carefully handling any sensitive user information returned by the endpoint
• Implementing proper error handling and logging to prevent the exposure of sensitive information

By maintaining a strong security posture around the User Info endpoint, the Jans Auth Server application can ensure the confidentiality and integrity of user data, which is crucial for maintaining user trust and compliance with security and privacy regulations.

Files Changed:

1. jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoService.java:

   • Implements the fillJwr method to populate the JsonWebResponse object with the jti and client_id claims.

2. jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebServiceImpl.java:

   • Injects the UserInfoService and uses it to fill the JsonWebResponse object.
   • Performs thorough validation of the access token and authorization grant before processing the user information request.

3. docs/admin/auth-server/endpoints/userinfo.md:

   • Documents the required claims in the User Info endpoint response, including sub, jti, and client_id.

4. jans-auth-server/server/src/test/java/io/jans/as/server/userinfo/ws/rs/UserInfoServiceTest.java:

   • Adds a new test method to ensure that the UserInfoService correctly fills the required claims in the JsonWebResponse object.

5. jans-auth-server/server/src/test/resources/testng.xml:

   • Adds the UserInfoServiceTest class to the TestNG configuration file, indicating the addition of new tests for the User Info endpoint functionality.

Code Analysis

We ran 7 analyzers against 5 files and 1 analyzer had findings. 6 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	6 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mo-auto]

Error: Hi @yuriyz, You did not reference an open issue in your PR. I attempted to create an issue for you.
Please update that issues' title and body and make sure I correctly referenced it in the above PRs body.

[sonarcloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'agama parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'keycloak-integration-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-pycloudlib'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'orm'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud