nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-02 16:42:50 -05:00
Code Activity

Test 1: add acr_values return validation value (#1285)

Browse Source 
* Part 1: add acr_values return validation value

* Update acr return value validation from OIDC specs

* acr validation prompt clarification
This commit is contained in:
Chad Scharf
2021-04-27 15:17:03 -04:00
committed by GitHub
parent 1bd515e8f0
commit 17db94190e
7 changed files with 48 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
bitwarden_license/src/Sso/Controllers/AccountController.cs
View File

@ -326,6 +326,16 @@ namespace Bit.Sso.Controllers
var externalUser = result.Principal;
// Validate acr claim against expectation before going further
if (!string.IsNullOrWhiteSpace(ssoConfigData.ExpectedReturnAcrValue))
{
var acrClaim = externalUser.FindFirst(JwtClaimTypes.AuthenticationContextClassReference);
if (acrClaim?.Value != ssoConfigData.ExpectedReturnAcrValue)
{
throw new Exception(_i18nService.T("AcrMissingOrInvalid"));
}
}
// Ensure the NameIdentifier used is not a transient name ID, if so, we need a different attribute
// for the user identifier.
static bool nameIdIsNotTransient(Claim c) => c.Type == ClaimTypes.NameIdentifier