Fix access token attributes for federated user #2647

shashimalcse · 2024-12-11T05:54:16Z

Proposed changes in this pull request

Previously JWTAccessTokenAttributesOIDCClaimHandler resolve attributes from the userstore level and JWT token will not contain Access Token attributes in the federation login flow. This PR improve the JWTAccessTokenAttributesOIDCClaimHandler to handle attributes of the federated user. Here we have move common methods from JWTAccessTokenAttributesOIDCClaimHandler and DefaultOIDCClaimCallbackHandler to OIDCClaimUtil.

Related Issues

JWT access token attributes are missing in the federation login flow wso2/product-is#22009

When should this PR be merged

[Please describe any preconditions that need to be addressed before we
can merge this pull request.]

Follow up actions

[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]

Checklist (for reviewing)

General

Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
Is the PR labeled correctly?

Functionality

Are all requirements met? Compare implemented functionality with the requirements specification.
Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
Are all UI and API inputs run through forms or serializers?
Are all external inputs validated and sanitized appropriately?
Does all branching logic have a default case?
Does this solution handle outliers and edge cases gracefully?
Are all external communications secured and restricted to SSL?

Documentation

Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

codecov · 2024-12-11T06:12:43Z

Codecov Report

Attention: Patch coverage is 56.31769% with 121 lines in your changes missing coverage. Please review.

Project coverage is 56.43%. Comparing base (0a9904a) to head (e0b3413).
Report is 38 commits behind head on master.

Files with missing lines	Patch %	Lines
...2/carbon/identity/openidconnect/OIDCClaimUtil.java	56.80%	46 Missing and 27 partials ⚠️
...openidconnect/JWTAccessTokenOIDCClaimsHandler.java	51.64%	34 Missing and 10 partials ⚠️
...penidconnect/DefaultOIDCClaimsCallbackHandler.java	76.47%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2647      +/-   ##
============================================
- Coverage     56.54%   56.43%   -0.12%     
+ Complexity     8201     8189      -12     
============================================
  Files           632      632              
  Lines         46689    46377     -312     
  Branches       8353     8348       -5     
============================================
- Hits          26400    26171     -229     
+ Misses        16581    16484      -97     
- Partials       3708     3722      +14

Flag	Coverage Δ
unit	`38.82% <56.31%> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

jenkins-is-staging · 2024-12-11T07:46:37Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/12271871336

jenkins-is-staging · 2024-12-11T09:36:39Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/12271871336
Status: success

jenkins-is-staging

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/12271871336

Thumimku · 2024-12-16T03:26:41Z

...rc/test/java/org/wso2/carbon/identity/openidconnect/JWTAccessTokenOIDCClaimsHandlerTest.java

+            oAuthServerConfiguration.when(OAuthServerConfiguration::getInstance)
+                    .thenReturn(oauthServerConfigurationMock);
+            try (MockedStatic<OAuth2Util> oAuth2Util = mockStatic(OAuth2Util.class)) {
+                oAuth2Util.when(() -> OAuth2Util.getAppInformationByClientId(any(), any())).thenReturn(


Let's change any to any(RequiredClass.class)

Thumimku · 2024-12-16T03:27:42Z

...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java

+    private static boolean isMultiValuedAttribute(String claimKey, String claimValue, String multiAttributeSeparator) {
+
+        // Address claim contains multi attribute separator but its not a multi valued attribute.
+        if (claimKey.equals(ADDRESS)) {


Suggested change

if (claimKey.equals(ADDRESS)) {

if (ADDRESS.equals(claimKey)) {

Thumimku · 2024-12-16T03:28:09Z

...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java

+     * @return Tenant domain of the service provider.
+     */
+    public static String getServiceProviderTenantDomain(OAuthAuthzReqMessageContext requestMsgCtx) {
+        String spTenantDomain = (String) requestMsgCtx.getProperty(MultitenantConstants.TENANT_DOMAIN);


add line after method signature.

Thumimku · 2024-12-16T03:33:14Z

...th/src/main/java/org/wso2/carbon/identity/openidconnect/JWTAccessTokenOIDCClaimsHandler.java

+            throws OAuthSystemException, IdentityOAuth2Exception {
+        // Map<"email", "[email protected]">
+        Map<String, Object> userClaimsInOIDCDialect;
+        // Get any user attributes that were cached against the access token


Suggested change

// Get any user attributes that were cached against the access token

// Get all user attributes that were cached against the access token

WDYT?

Thumimku · 2024-12-16T03:37:44Z

...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java

+            log.debug("Retrieving claims cached against authorization_code for user: " +
+                    requestMsgCtx.getAuthorizedUser());
+        }
+        if (isEmpty(userAttributes)) {


line 749 also checking same condition right? this is getting repeated in this method please check

here if userAttributes are empty we trying to get userAttributes 742, then after we check empty

shashimalcse · 2024-12-18T14:44:24Z

closed with this : #2653

Fix access token attributes for fedarated user

1ab832c

Add unit tests

e0b3413

shashimalcse marked this pull request as ready for review December 11, 2024 06:59

jenkins-is-staging approved these changes Dec 11, 2024

View reviewed changes

Thumimku reviewed Dec 16, 2024

View reviewed changes

shashimalcse closed this Dec 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix access token attributes for federated user #2647

Fix access token attributes for federated user #2647

shashimalcse commented Dec 11, 2024 •

edited

Loading

codecov bot commented Dec 11, 2024 •

edited

Loading

jenkins-is-staging commented Dec 11, 2024

jenkins-is-staging commented Dec 11, 2024

jenkins-is-staging left a comment

Thumimku Dec 16, 2024

Thumimku Dec 16, 2024

Thumimku Dec 16, 2024

Thumimku Dec 16, 2024

Thumimku Dec 16, 2024

shashimalcse Dec 16, 2024

shashimalcse commented Dec 18, 2024

	if (claimKey.equals(ADDRESS)) {
	if (ADDRESS.equals(claimKey)) {

	// Get any user attributes that were cached against the access token
	// Get all user attributes that were cached against the access token

Fix access token attributes for federated user #2647

Fix access token attributes for federated user #2647

Conversation

shashimalcse commented Dec 11, 2024 • edited Loading

Proposed changes in this pull request

Related Issues

When should this PR be merged

Follow up actions

Checklist (for reviewing)

General

Functionality

Code

Tests

Security

Documentation

codecov bot commented Dec 11, 2024 • edited Loading

Codecov Report

jenkins-is-staging commented Dec 11, 2024

jenkins-is-staging commented Dec 11, 2024

jenkins-is-staging left a comment

Choose a reason for hiding this comment

Thumimku Dec 16, 2024

Choose a reason for hiding this comment

Thumimku Dec 16, 2024

Choose a reason for hiding this comment

Thumimku Dec 16, 2024

Choose a reason for hiding this comment

Thumimku Dec 16, 2024

Choose a reason for hiding this comment

Thumimku Dec 16, 2024

Choose a reason for hiding this comment

shashimalcse Dec 16, 2024

Choose a reason for hiding this comment

shashimalcse commented Dec 18, 2024

shashimalcse commented Dec 11, 2024 •

edited

Loading

codecov bot commented Dec 11, 2024 •

edited

Loading