Fixes #286

Author: oharsta

oidc/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.openconext</groupId>
         <artifactId>oidcng-parent</artifactId>
-        <version>8.1.0</version>
+        <version>8.2.0</version>
     </parent>
 
     <dependencyManagement>

oidc/src/main/java/oidc/endpoints/SecureEndpoint.java

@@ -1,16 +1,24 @@
 package oidc.endpoints;
 
 import com.nimbusds.oauth2.sdk.auth.PlainClientSecret;
+import com.nimbusds.oauth2.sdk.auth.Secret;
 import oidc.model.OpenIDClient;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 
+import java.util.Arrays;
+
 public class SecureEndpoint {
 
     private final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
 
-    //See https://www.pivotaltracker.com/story/show/165565558
     boolean secretsMatch(PlainClientSecret clientSecret, OpenIDClient openIDClient) {
-        return passwordEncoder.matches(clientSecret.getClientSecret().getValue(), openIDClient.getSecret());
+        //See https://github.com/OpenConext/OpenConext-oidcng/issues/286
+        String secret = clientSecret.getClientSecret().getValue();
+        if (secret.getBytes().length > 72) {
+            byte[] first72bytes =  Arrays.copyOf(secret.getBytes(), 72);
+            secret = new String(first72bytes);
+        }
+        return passwordEncoder.matches(secret, openIDClient.getSecret());
     }
 
 }

oidc/src/test/java/oidc/endpoints/SecureEndpointTest.java

@@ -9,13 +9,17 @@
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.test.util.ReflectionTestUtils;
 
+import java.security.SecureRandom;
+import java.util.Base64;
 import java.util.UUID;
 
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
 public class SecureEndpointTest {
 
     private final BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
+    private final SecureRandom secureRandom = new SecureRandom();
 
     @Test
     public void secretsMatch() {
@@ -31,4 +35,45 @@ public void secretsMatch() {
         boolean matches = secureEndpoint.secretsMatch(plainClientSecret, openIDClient);
         assertTrue(matches);
     }
-}
+
+    @Test
+    public void longSecrets() {
+        int numBytes = 54;// Because of base64 encoding, this will become 72 bytes (54 * 4 / 3 = 72);
+        byte[] randomBytes = new byte[numBytes];
+        secureRandom.nextBytes(randomBytes);
+        String secret = Base64.getUrlEncoder().withoutPadding().encodeToString(randomBytes);
+        assertEquals(72, secret.getBytes().length);
+        //must not be larger the 72, otherwise the encoding fails
+        String encoded = passwordEncoder.encode(secret);
+        OpenIDClient openIDClient = new OpenIDClient();
+        ReflectionTestUtils.setField(openIDClient, "secret", encoded);
+
+        SecureEndpoint secureEndpoint = new SecureEndpoint();
+        ClientID clientID = new ClientID("test");
+        Secret theSecret = new Secret(secret +
+            "does_not_matter_anymore_only_the_first_72_bytes_are used");
+        PlainClientSecret plainClientSecret = new ClientSecretBasic(clientID, theSecret);
+
+        boolean matches = secureEndpoint.secretsMatch(plainClientSecret, openIDClient);
+        assertTrue(matches);
+    }
+
+    @Test
+    public void existingLongSecrets() {
+        String secret = "AsNZ_H_IvWj_z19o7thTO_S83MOEWWSJ_Hiwt4Ms2qMEvPpvMia7SwbsvCLcLIu9h5rdEMYHFGsJD0eTcH0sRjj4OhghMlgfJQ";
+        assertTrue(secret.getBytes().length > 72);
+
+        String encoded = "$2a$10$F1eD3M74d3BS5FnI1moxme89R6rE/doNNhDpeIH9NgJWfF6lQRTd6";
+        OpenIDClient openIDClient = new OpenIDClient();
+        ReflectionTestUtils.setField(openIDClient, "secret", encoded);
+
+        SecureEndpoint secureEndpoint = new SecureEndpoint();
+        ClientID clientID = new ClientID("test");
+        Secret theSecret = new Secret(secret);
+        PlainClientSecret plainClientSecret = new ClientSecretBasic(clientID, theSecret);
+
+        boolean matches = secureEndpoint.secretsMatch(plainClientSecret, openIDClient);
+        assertTrue(matches);
+    }
+
+}

pom.xml

@@ -11,7 +11,7 @@
 
     <groupId>org.openconext</groupId>
     <artifactId>oidcng-parent</artifactId>
-    <version>8.1.0</version>
+    <version>8.2.0</version>
     <name>oidcng</name>
     <packaging>pom</packaging>
 

release/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.openconext</groupId>
         <artifactId>oidcng-parent</artifactId>
-        <version>8.1.0</version>
+        <version>8.2.0</version>
     </parent>
 
     <artifactId>oidcng-release</artifactId>