dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use nonce in Authentication Code Flow (#184)

Browse Source
This commit is contained in:
Clément Oudot 2015-03-17 12:56:11 +00:00
parent 89e3678bdf
commit 4e7f4eb85e
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/IssuerDBOpenIDConnect.pm
View File

@ -186,9 +186,11 @@ sub issuerForUnAuthUser {
acr => $id_token_acr, # Authentication Context Class Reference
azp => $client_id, # Authorized party
# TODO amr
# TODO nonce
};
my $nonce = $codeSession->data->{nonce};
$id_token_payload_hash->{nonce} = $nonce if defined $nonce;
# Create ID Token
my $id_token = $self->createIDToken( $id_token_payload_hash, $rp );
@ -467,6 +469,7 @@ sub issuerForAuthUser {
scope => $oidc_request->{'scope'},
user_session_id => $session_id,
_utime => time,
nonce => $oidc_request->{'nonce'},
}
);