{"action":"created","issue":{"url":"https://api.github.com/repos/GluuFederation/oxTrust/issues/271","repository_url":"https://api.github.com/repos/GluuFederation/oxTrust","labels_url":"https://api.github.com/repos/GluuFederation/oxTrust/issues/271/labels{/name}","comments_url":"https://api.github.com/repos/GluuFederation/oxTrust/issues/271/comments","events_url":"https://api.github.com/repos/GluuFederation/oxTrust/issues/271/events","html_url":"https://github.com/GluuFederation/oxTrust/issues/271","id":158516768,"number":271,"title":"\"Update/Add client\" page allows to set id_token's signing algorithm to none, resulting in unsigned id_token","user":{"login":"aliaksander-samuseu","id":11802046,"avatar_url":"https://avatars.githubusercontent.com/u/11802046?v=3","gravatar_id":"","url":"https://api.github.com/users/aliaksander-samuseu","html_url":"https://github.com/aliaksander-samuseu","followers_url":"https://api.github.com/users/aliaksander-samuseu/followers","following_url":"https://api.github.com/users/aliaksander-samuseu/following{/other_user}","gists_url":"https://api.github.com/users/aliaksander-samuseu/gists{/gist_id}","starred_url":"https://api.github.com/users/aliaksander-samuseu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aliaksander-samuseu/subscriptions","organizations_url":"https://api.github.com/users/aliaksander-samuseu/orgs","repos_url":"https://api.github.com/users/aliaksander-samuseu/repos","events_url":"https://api.github.com/users/aliaksander-samuseu/events{/privacy}","received_events_url":"https://api.github.com/users/aliaksander-samuseu/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GluuFederation/oxTrust/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":{"login":"qbert2k","id":2474616,"avatar_url":"https://avatars.githubusercontent.com/u/2474616?v=3","gravatar_id":"","url":"https://api.github.com/users/qbert2k","html_url":"https://github.com/qbert2k","followers_url":"https://api.github.com/users/qbert2k/followers","following_url":"https://api.github.com/users/qbert2k/following{/other_user}","gists_url":"https://api.github.com/users/qbert2k/gists{/gist_id}","starred_url":"https://api.github.com/users/qbert2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qbert2k/subscriptions","organizations_url":"https://api.github.com/users/qbert2k/orgs","repos_url":"https://api.github.com/users/qbert2k/repos","events_url":"https://api.github.com/users/qbert2k/events{/privacy}","received_events_url":"https://api.github.com/users/qbert2k/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/GluuFederation/oxTrust/milestones/5","html_url":"https://github.com/GluuFederation/oxTrust/milestones/CE%202.4.4","labels_url":"https://api.github.com/repos/GluuFederation/oxTrust/milestones/5/labels","id":1507336,"number":5,"title":"CE 2.4.4","description":"","creator":{"login":"willow9886","id":5271048,"avatar_url":"https://avatars.githubusercontent.com/u/5271048?v=3","gravatar_id":"","url":"https://api.github.com/users/willow9886","html_url":"https://github.com/willow9886","followers_url":"https://api.github.com/users/willow9886/followers","following_url":"https://api.github.com/users/willow9886/following{/other_user}","gists_url":"https://api.github.com/users/willow9886/gists{/gist_id}","starred_url":"https://api.github.com/users/willow9886/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willow9886/subscriptions","organizations_url":"https://api.github.com/users/willow9886/orgs","repos_url":"https://api.github.com/users/willow9886/repos","events_url":"https://api.github.com/users/willow9886/events{/privacy}","received_events_url":"https://api.github.com/users/willow9886/received_events","type":"User","site_admin":false},"open_issues":31,"closed_issues":10,"state":"open","created_at":"2016-01-14T17:07:11Z","updated_at":"2016-06-04T18:16:05Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-06-04T18:15:41Z","updated_at":"2016-06-05T21:09:01Z","closed_at":null,"body":"Steps to reproduce:\r\n\r\n1) Log in to web ui as admin\r\n2) Create some basic OIDC client entry with minimal set of required features intended for \"authz code\" flow, while setting \"JWS alg Algorithm for signing the ID Token\" property to \"none\"\r\n3) Try to follow  \"authz code\" flow using this client\r\n\r\nResult:\r\n\r\nid_token is returned from token endpoint as unsigned jwt structure what violates OIDC core spec:\r\n\r\n> ID Tokens MUST be signed using JWS [JWS] and optionally both signed and then encrypted using JWS [JWS] and JWE [JWE] respectively, thereby providing authentication, integrity, non-repudiation, and optionally, confidentiality\r\n\r\n![oidc-unsigned-idtoken2](https://cloud.githubusercontent.com/assets/11802046/15801327/252ffa40-2a9a-11e6-93fb-7f8238c0e7ed.jpg)\r\n\r\nIt also seems that this ability has been present in Gluu for some time already, as you can achieve the same in 2.3.x instance by modifying corresponding attribute in client's LDAP entry directly, by explicitly assigning \"none\" value to attribute of client's entry named \"oxAuthIdTokenSignedResponseAlg\".\r\n\r\nDo we really need this allowed? Mb it shouldn't be at least that easy to enable (i.e. no need to put it to web UI)?"},"comment":{"url":"https://api.github.com/repos/GluuFederation/oxTrust/issues/comments/223837781","html_url":"https://github.com/GluuFederation/oxTrust/issues/271#issuecomment-223837781","issue_url":"https://api.github.com/repos/GluuFederation/oxTrust/issues/271","id":223837781,"user":{"login":"yuriyz","id":2013070,"avatar_url":"https://avatars.githubusercontent.com/u/2013070?v=3","gravatar_id":"","url":"https://api.github.com/users/yuriyz","html_url":"https://github.com/yuriyz","followers_url":"https://api.github.com/users/yuriyz/followers","following_url":"https://api.github.com/users/yuriyz/following{/other_user}","gists_url":"https://api.github.com/users/yuriyz/gists{/gist_id}","starred_url":"https://api.github.com/users/yuriyz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yuriyz/subscriptions","organizations_url":"https://api.github.com/users/yuriyz/orgs","repos_url":"https://api.github.com/users/yuriyz/repos","events_url":"https://api.github.com/users/yuriyz/events{/privacy}","received_events_url":"https://api.github.com/users/yuriyz/received_events","type":"User","site_admin":false},"created_at":"2016-06-05T21:09:01Z","updated_at":"2016-06-05T21:09:01Z","body":"@qbert2k Javier, is it required by our oxauth acceptance test? because it seems to be a bug."}}
{"actor":{"display_login":"yuriyz"}}