From 27bd0f252b6afe599656a6ae04be4fb77f97e4ef Mon Sep 17 00:00:00 2001 From: Nikolaj Volgushev Date: Fri, 4 Jul 2025 11:41:37 +0200 Subject: [PATCH] Short circuit failure handling in OIDC flow --- .../oidc/OpenIdConnectAuthenticator.java | 36 ++++++++----------- 1 file changed, 14 insertions(+), 22 deletions(-) diff --git a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectAuthenticator.java b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectAuthenticator.java index 8d02992c2ec3a..e92f4a6cf93b4 100644 --- a/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectAuthenticator.java +++ b/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/oidc/OpenIdConnectAuthenticator.java @@ -477,7 +477,20 @@ static void handleUserinfoResponse( if (httpResponse.getStatusLine().getStatusCode() == 200) { if (ContentType.parse(contentHeader.getValue()).getMimeType().equals("application/json")) { final JWTClaimsSet userInfoClaims = JWTClaimsSet.parse(contentAsString); - validateUserInfoResponse(userInfoClaims, verifiedIdTokenClaims.getSubject(), claimsListener); + String expectedSub = verifiedIdTokenClaims.getSubject(); + if (userInfoClaims.getSubject().isEmpty()) { + claimsListener.onFailure(new ElasticsearchSecurityException("Userinfo Response did not contain a sub Claim")); + return; + } else if (userInfoClaims.getSubject().equals(expectedSub) == false) { + claimsListener.onFailure( + new ElasticsearchSecurityException( + "Userinfo Response is not valid as it is for " + "subject [{}] while the ID Token was for subject [{}]", + userInfoClaims.getSubject(), + expectedSub + ) + ); + return; + } if (LOGGER.isTraceEnabled()) { LOGGER.trace("Successfully retrieved user information: [{}]", userInfoClaims); } @@ -527,27 +540,6 @@ static void handleUserinfoResponse( } } - /** - * Validates that the userinfo response contains a sub Claim and that this claim value is the same as the one returned in the ID Token - */ - private static void validateUserInfoResponse( - JWTClaimsSet userInfoClaims, - String expectedSub, - ActionListener claimsListener - ) { - if (userInfoClaims.getSubject().isEmpty()) { - claimsListener.onFailure(new ElasticsearchSecurityException("Userinfo Response did not contain a sub Claim")); - } else if (userInfoClaims.getSubject().equals(expectedSub) == false) { - claimsListener.onFailure( - new ElasticsearchSecurityException( - "Userinfo Response is not valid as it is for " + "subject [{}] while the ID Token was for subject [{}]", - userInfoClaims.getSubject(), - expectedSub - ) - ); - } - } - /** * Attempts to make a request to the Token Endpoint of the OpenID Connect provider in order to exchange an * authorization code for an Id Token (and potentially an Access Token)