Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-5335

OAuth2: /frrest/oauth2/token query does not work for amadmin

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Duplicate
    • Affects Version/s: 12.0.0, 13.0.0
    • Fix Version/s: None
    • Component/s: oauth2, OpenID Connect
    • Labels:
    • Sprint:
      Sustaining Sprint 12, AM Sustaining Sprint 13
    • Support Ticket IDs:

      Description

      The /frrest/oauth2/token endpoint (org.forgerock.openam.oauth2.rest.TokenResource) allows users to query for their own OAuth2 access tokens and refresh tokens - see http://openam.forgerock.org/openam-documentation/openam-doc-source/doc/dev-guide/index.html#rest-api-oauth2-token-admin-endpoint . The code and documentation examples suggest that amadmin (or equivalent) should be able to query for any tokens, but this does not work. For example:

      $ curl -X GET -H "iPlanetDirectoryPro: $ADMIN" 'http://neil.example.com:8080/openam/frrest/oauth2/token?_queryId=access_token'
      {"result":[],"resultCount":0,"pagedResultsCookie":null,"remainingPagedResults":-1}
      

      (At this point in time there was 1 OAuth2 access_token and 1 OIDC id_token in the token store for user "test").

      The problem is due to the check to see if the current user is the admin user. If they are then a query filter is added for "username=*". This gets translated into the literal LDAP query filter "username=\2A" (where \2A is the LDAP escape for a *) and so only matches tokens with that exact username.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                bthalmayr Bernhard Thalmayr
                Reporter:
                neil.madden Neil Madden
              • Votes:
                2 Vote for this issue
                Watchers:
                8 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 6h
                  6h
                  Remaining:
                  Remaining Estimate - 6h
                  6h
                  Logged:
                  Time Spent - Not Specified
                  Not Specified