Oauth2: Random error when revoke a token about openam

[maximthomas]

@martins1930, I've just created test with apache http client to reproduce your case and could not do it. Could you provide more details about your environment? (OpenAM version, JDK version, installation type, and so on...)

       @Test
	public void doTest() throws Exception {
		
		String server = "http://test.openam.org.ru:8080/openam";
		
		Set<String> tokens = new HashSet<>();
		
		CloseableHttpClient httpclient = HttpClientBuilder.create().disableRedirectHandling().build();
		//obtain tokens
		for(int i = 0; i < 1000; i ++) {
			HttpPost httpost = new HttpPost(server + "/oauth2/access_token");
			List<NameValuePair> nvps = new ArrayList<NameValuePair>();
			nvps.add(new BasicNameValuePair("client_secret", "foobar"));
			nvps.add(new BasicNameValuePair("client_id", "foobar_client_id"));
			nvps.add(new BasicNameValuePair("grant_type", "password"));
			nvps.add(new BasicNameValuePair("username", "foouser"));
			nvps.add(new BasicNameValuePair("password", "foopassword"));
			nvps.add(new BasicNameValuePair("realm", "/"));
			
			httpost.setEntity(new UrlEncodedFormEntity(nvps));
			HttpResponse response = httpclient.execute(httpost); 
			String res=EntityUtils.toString(response.getEntity(),"UTF-8");
			
			JSONObject jsonObject = new JSONObject(res);
			
			String access_token = jsonObject.getString("access_token");
			
			tokens.add(access_token);
			
			System.err.println("obtained token: " +  access_token);
		}
		//revoke tokens
		for(String access_token: tokens) {
			HttpPost httpost = new HttpPost(server + "/oauth2/token/revoke");
			ArrayList<NameValuePair> nvps = new ArrayList<NameValuePair>();
			nvps.add(new BasicNameValuePair("realm", "/"));
			nvps.add(new BasicNameValuePair("token", access_token));
			nvps.add(new BasicNameValuePair("client_secret", "foobar"));
			nvps.add(new BasicNameValuePair("client_id", "foobar_client_id"));
			
			
			httpost.setEntity(new UrlEncodedFormEntity(nvps));
			HttpResponse response = httpclient.execute(httpost); 
			String res = EntityUtils.toString(response.getEntity(),"UTF-8");
			
			JSONObject jsonObject = new JSONObject(res);
			
			Assert.assertEquals(200, response.getStatusLine().getStatusCode());
			
			System.err.println(access_token + " : " + response.getStatusLine() + ":" + jsonObject.toString());
		}
	}

[martins1930]

hi @maximthomas ,

I'm using the version 14.1.4 , I installed the OpenAM using docker, below is the docker-compose.yml that I'm using:

  openam:
    image: openidentityplatform/openam:14.1.4
    hostname: openam.example.com
    ports:
      - "8778:8080"  

I have configured the openam in the following way:

1. Click on the link "Create Default Configuration" that is shown in the image below:
   

2. Create the realm "Myrealm" as is shown in the image below:
   

3. In the "Realm Overview" page click on "Configure Oauth Provider" and then on "Configure Oauth2" and click on "Issue Refresh Token" as is shown in the image below:
   

4. Go to "Subjects" and create the user [email protected] with the password foobar1234 . The following image shows how the user looks like:
   

5. Go to "Agents" -> "OAuth 2.0/OpenID Connect Client" and create a new agent with the name "MyAgent" as is shown in the image below:
   

6. In the list of agents click on the agent "MyAgent" and add the "cn" to Scope(s) , Claim(s) and Default Scope(s) as is shown in the image below:
   
   

7. End of configuration.

Then to reproduce the bug execute this script:

#!/bin/bash

SERVER=http://openam.example.com:8778
CLIENT_SECRET=myagent1234
CLIENT_ID=myAgent
USERNAME=myuser%40foobar.com
PASSWORD=foobar1234
REALM=%2FMyrealm

for i in `seq 1 1000`;
do

    echo "Starting test $i =================="
	RESPONSE=$(curl -X "POST" "$SERVER/openam/oauth2/access_token?client_secret=$CLIENT_SECRET&client_id=$CLIENT_ID&grant_type=password&username=$USERNAME&password=$PASSWORD&realm=$REALM" \
	 -H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' --silent)

 	TOKEN=$(echo "$RESPONSE" | perl -lane 'while (/."access_token":"(.*?)".*/g) {print $1}')

    echo "The token from OpenAM is: $TOKEN"

    REVOKE_RESPONSE_CODE=$(curl -X "POST" "$SERVER/openam/oauth2/token/revoke?realm=$REALM&token=$TOKEN&client_secret=$CLIENT_SECRET&client_id=$CLIENT_ID" \
	 -H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' --write-out %{http_code} --silent --output /dev/null)

    echo "The response code of the revoke is: $REVOKE_RESPONSE_CODE"

    if [ "$REVOKE_RESPONSE_CODE" != "200" ]
    then
        echo "Error revoking the token."
        exit 1
    fi

done

Note that when I run the script with the CLIENT_ID with the value myAgent it thows random errors when revoke the token,
but when I set the CLIENT_ID with the value MyAgent it works fine,
therefore seems that the problem is due to a problem with the case sensitive on the parameter client_id in the revoke API ?

Regards,
Martin.

[maximthomas]

Hi, @martins1930
You are right, when openam revokes the token, it compares client_id associated with token inside OpenAM with client_id in reqest parameter. If they are not match, OpenAM throws error. client_id parameter due to rfc6749 - 1.9 should be case sensitive

[martins1930]

ok, thank you @maximthomas !
But I think It would be nice if OpenAM always return an error when the case doesn't match, because the random behaviour of the revoke API is confusing.