Skip to content

fix(oidc): map ErrSubjectInvalid to invalid_grant instead of server_error #950

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
youdie006 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(oidc): map ErrSubjectInvalid to invalid_grant instead of server_error #950

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pkg/oidc/error.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,7 @@ func DefaultToServerError(err error, description string) *Error {
oidcErr = ErrInvalidRequest().WithParent(err).WithDescription("%s", description)
case errors.Is(err, ErrIssuerInvalid),
errors.Is(err, ErrSubjectMissing),
errors.Is(err, ErrSubjectInvalid),

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve invalid_client for private-key JWT assertions

When a private_key_jwt used to authenticate an authorization-code or refresh-token request has iss != sub, VerifyJWTAssertion returns this same sentinel and AuthorizePrivateJWTKey propagates it unchanged, so RequestError now reports invalid_grant. RFC 7523 §3.2 requires invalid_client for an invalid JWT used as client authentication; invalid_grant applies to the JWT authorization-grant flow in §3.1. Because this verifier is shared by both modes, translate the error in the mode-specific callers rather than mapping it globally here.

Useful? React with 👍 / 👎.

errors.Is(err, ErrAudience),
errors.Is(err, ErrAzpMissing),
errors.Is(err, ErrAzpInvalid),
Expand Down
10 changes: 10 additions & 0 deletions pkg/oidc/error_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,16 @@ func TestDefaultToServerError(t *testing.T) {
}
}

// TestDefaultToServerError_SubjectInvalid guards against a regression where
// ErrSubjectInvalid (returned by the JWT profile grant when iss != sub) was not
// listed in the invalid_grant case and fell through to server_error (HTTP 500).
// A rejected client assertion must map to invalid_grant per RFC 7523, matching
// the sibling ErrSubjectMissing.
func TestDefaultToServerError_SubjectInvalid(t *testing.T) {
got := DefaultToServerError(ErrSubjectInvalid, ErrSubjectInvalid.Error())
assert.Equal(t, InvalidGrant, got.ErrorType)
}

func TestError_LogLevel(t *testing.T) {
tests := []struct {
name string
Expand Down
Loading