cloudfoundry / cloudfoundry/uaa

introspect endpoint don't follow rfc7662

Open
#1,229 4 comments 5 reactions 1 assignee View on GitHub

@strehle is already working on this.

Since Nov 18, 2022.

bug unscheduled waiting-4-pr
Dominant language
Java
Stars
1.6k
Forks
844
Avg merge
2d 5h
Merged PRs (30d)
27

Description

SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org

Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.

What version of UAA are you running?

http://docs.cloudfoundry.org/api/uaa/version/74.15.0

What did you do?

Hit /introspect endpoint to fetch the scope.

What did you expect to see? What goal are you trying to achieve with the UAA?

According to RFC, the SCOPE should be a JSON String containing a space-separated list of scopes associated with the token. And this is how all the frameworks like Spring Security etc. and most of the major programming languages has built by following RFC.

RFC for Reference

"scope" : "scim.userids openid cloud_controller.read password.write cloud_controller.write

What did you see instead?

I get the scope as an array like below:
"scope" : [ "scim.userids", "openid", "cloud_controller.read", "password.write", "cloud_controller.write" ]

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.