8000 [OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity by tdiesler · Pull Request #48321 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity #48321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mposolda merged 2 commits into from
Apr 29, 2026
Merged

[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-header-case-sensitivity #48321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b30654e
[OID4VCI-FAPI2] Pass fapi2-security-profile-final-access-token-type-h…
tdiesler Apr 21, 2026
0a2ebf7
-- add basic Authorization scheme case-sensitivity testing
tdiesler Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion services/src/main/java/org/keycloak/protocol/oidc/endpoints/UserInfoEndpoint.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ public Response issueUserInfoPost() {
MultivaluedMap<String, String> formParams = request.getDecodedFormParameters();
checkAccessTokenDuplicated(formParams);
String accessToken = formParams.getFirst(OAuth2Constants.ACCESS_TOKEN);
authHeader = accessToken == null ? null : new AppAuthManager.AuthHeader(AppAuthManager.BEARER, accessToken);
authHeader = accessToken == null ? null : new AppAuthManager.AuthHeader(TokenUtil.TOKEN_TYPE_BEARER, accessToken);
authorization(authHeader);
}
} catch (IllegalArgumentException e) {
Expand Down
17 changes: 9 additions & 8 deletions services/src/main/java/org/keycloak/services/managers/AppAuthManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,18 +30,18 @@
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.services.util.DPoPUtil;
import org.keycloak.util.TokenUtil;

import org.jboss.logging.Logger;

import static org.keycloak.util.TokenUtil.TOKEN_TYPE_BEARER;
import static org.keycloak.util.TokenUtil.TOKEN_TYPE_DPOP;

/**
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
*/
public class AppAuthManager extends AuthenticationManager {

public static final String BEARER = "Bearer";

@Override
public AuthResult authenticateIdentityCookie(KeycloakSession session, RealmModel realm) {
AuthResult authResult = super.authenticateIdentityCookie(session, realm);
Expand Down Expand Up @@ -72,14 +72,15 @@ private static AuthHeader extractTokenStringFromAuthHeader(String authHeader) {
String typeString = authHeader.substring(0, indexOfSpace);
String tokenString = authHeader.substring(indexOfSpace + 1);

boolean isBearerHeader = typeString.equalsIgnoreCase(BEARER);
// Auth schemes are case insensitive per RFC9110-11.1
// Checked by fapi2-security-profile-final-access-token-type-header-case-sensitivity
boolean isBearerHeader = typeString.equalsIgnoreCase(TOKEN_TYPE_BEARER);
if (!Profile.isFeatureEnabled(Profile.Feature.DPOP)) {
if (!isBearerHeader) {
return null;
}
} else {
// "Bearer" is case-insensitive for historical reasons. "DPoP" is case-sensitive to follow the spec.
if (!isBearerHeader && !typeString.equals(TokenUtil.TOKEN_TYPE_DPOP)) {
if (!isBearerHeader && !typeString.equalsIgnoreCase(TOKEN_TYPE_DPOP)) {
return null;
}
}
Expand All @@ -104,7 +105,7 @@ public static AuthHeader extractAuthorizationHeaderTokenOrReturnNull(HttpHeaders
return null;
}
if (authHeaders.size() != 1) {
throw new NotAuthorizedException(BEARER);
throw new NotAuthorizedException(TOKEN_TYPE_BEARER);
}
String authHeader = headers.getRequestHeaders().getFirst(HttpHeaders.AUTHORIZATION);
return extractTokenStringFromAuthHeader(authHeader);
Expand All @@ -124,7 +125,7 @@ public static String extractAuthorizationHeaderToken(HttpHeaders headers) {
}
AuthHeader parsedHeader = extractTokenStringFromAuthHeader(authHeader);
if (parsedHeader == null ){
throw new NotAuthorizedException(BEARER);
throw new NotAuthorizedException(TOKEN_TYPE_BEARER);
}
return parsedHeader.getToken();
}
Expand Down
6 changes: 3 additions & 3 deletions services/src/main/java/org/keycloak/services/util/DPoPUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,13 +242,13 @@ public static TokenVerifier<AccessToken> withDPoPVerifier(TokenVerifier<AccessTo
boolean isSchemeDPoP = false;
if (StringUtil.isNotBlank(validator.authHeader)) {
String[] split = WHITESPACES.split(validator.authHeader);
isSchemeDPoP = TokenUtil.TOKEN_TYPE_DPOP.equals(split[0]);
isSchemeDPoP = TokenUtil.TOKEN_TYPE_DPOP.equalsIgnoreCase(split[0]);
}

if (!isSchemeDPoP && DPoPUtil.DPOP_TOKEN_TYPE.equals(token.getType())) {
if (!isSchemeDPoP && DPoPUtil.DPOP_TOKEN_TYPE.equalsIgnoreCase(token.getType())) {
throw new VerificationException("The access token type is DPoP but Authorization Header is not DPoP");
}
if (isSchemeDPoP && !DPoPUtil.DPOP_TOKEN_TYPE.equals(token.getType())) {
if (isSchemeDPoP && !DPoPUtil.DPOP_TOKEN_TYPE.equalsIgnoreCase(token.getType())) {
throw new VerificationException("The access token type is not DPoP but Authorization Header is DPoP");
}
ClientModel clientModel = realm.getClientByClientId(token.getIssuedFor());
Expand Down
19 changes: 17 additions & 2 deletions ...ntegration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/DPoPTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ public void testDuplicatedAuthorizationHeaderOnUserInfo() throws Exception {

get = new HttpGet(oauth.getEndpoints().getUserInfo());
get.addHeader("Accept", MediaType.APPLICATION_JSON);
String authorization = "DPoP" + " " + response.getAccessToken();
String authorization = TokenUtil.TOKEN_TYPE_DPOP + " " + response.getAccessToken();
get.addHeader(HttpHeaders.AUTHORIZATION, authorization);
get.addHeader(HttpHeaders.AUTHORIZATION, authorization);

Expand All @@ -214,7 +214,7 @@ public void testDPoPAccessTokenButBearerAuthorizationHeader() throws Exception {

get = new HttpGet(oauth.getEndpoints().getUserInfo());
get.addHeader("Accept", MediaType.APPLICATION_JSON);
String authorization = "Bearer" + " " + response.getAccessToken();
String authorization = TokenUtil.TOKEN_TYPE_BEARER + " " + response.getAccessToken();
get.addHeader(HttpHeaders.AUTHORIZATION, authorization);

UserInfoResponse userInfoResponse = new UserInfoResponse(oauth.httpClient().get().execute(get));
Expand All @@ -223,6 +223,21 @@ public void testDPoPAccessTokenButBearerAuthorizationHeader() throws Exception {
oauth.doLogout(response.getRefreshToken());
}

@Test
public void testDPoPAccessTokenBearerAuthorizationCaseSensitivity() throws Exception {
KeyPair rsaKeyPair = KeyUtils.generateRsaKeyPair(2048);
AccessTokenResponse response = getDPoPBindAccessToken(rsaKeyPair);

get = new HttpGet(oauth.getEndpoints().getUserInfo());
get.addHeader("Accept", MediaType.APPLICATION_JSON);
String authorization = "BeArEr" + " " + response.getAccessToken();
get.addHeader(HttpHeaders.AUTHORIZATION, authorization);

UserInfoResponse userInfoResponse = new UserInfoResponse(oauth.httpClient().get().execute(get));
assertEquals(401, userInfoResponse.getStatusCode());

oauth.doLogout(response.getRefreshToken());
}

@Test
public void testDPoPByPublicClientWithDpopJkt() throws Exception {
Expand Down
Loading
0