Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add tenant domain to jwt payload #2401

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add tenant domain to jwt payload #2401

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5323bb8
Add tenant domain to jwt payload
chamilaadhi Mar 4, 2024
863a019
Address review comments
chamilaadhi Mar 4, 2024
083e5de
Add review changes
chamilaadhi Mar 5, 2024
e65e3cc
Add review comments
chamilaadhi Mar 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions ...y.oauth/src/main/java/org/wso2/carbon/identity/oauth/config/OAuthServerConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,6 +317,7 @@ public class OAuthServerConfiguration {
private int deviceCodePollingInterval = 5000;
private String deviceCodeKeySet = "BCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz23456789";
private String deviceAuthzEPUrl = null;
private boolean addTenantDomainToAccessTokenEnabled = false;
private List<String> supportedTokenEndpointSigningAlgorithms = new ArrayList<>();
private Boolean roleBasedScopeIssuerEnabledConfig = false;

Expand Down Expand Up @@ -522,6 +523,9 @@ private void buildOAuthServerConfiguration() {

// Read config for using legacy permission access for user based auth.
parseUseLegacyPermissionAccessForUserBasedAuth(oauthElem);

// read domain information setting config.
isAddTenantDomainToAccessTokenEnabled(oauthElem);
}

/**
Expand Down Expand Up @@ -748,6 +752,12 @@ public boolean isSkipOIDCClaimsForClientCredentialGrant() {

return skipOIDCClaimsForClientCredentialGrant;
}

public boolean isAddTenantDomainToAccessTokenEnabled() {

return addTenantDomainToAccessTokenEnabled;
}

/**
* instantiate the OAuth token generator. to override the default implementation, one can specify the custom class
* in the identity.xml.
Expand Down Expand Up @@ -3456,6 +3466,19 @@ private void parseTokenRenewalPerRequestConfiguration(OMElement oauthConfigElem)
}
}


private void isAddTenantDomainToAccessTokenEnabled(OMElement oauthConfigElem) {

OMElement enableAddDomainElem = oauthConfigElem.getFirstChildWithName(getQNameWithIdentityNS(
ConfigElements.ADD_DOMAIN_TO_ACCESS_TOKEN));
if (enableAddDomainElem != null) {
addTenantDomainToAccessTokenEnabled = Boolean.parseBoolean(enableAddDomainElem.getText());
}
if (log.isDebugEnabled()) {
log.debug("AddTenantDomainToAccessTokenEnabled was set to : " + addTenantDomainToAccessTokenEnabled);
}
}

/**
* Parses the map federated users to local configuration.
*
Expand Down Expand Up @@ -3778,6 +3801,8 @@ private class ConfigElements {
private static final String OPENID_CONNECT_ADD_TENANT_DOMAIN_TO_ID_TOKEN = "AddTenantDomainToIdToken";
// Property to decide whether to add userstore domain to id_token.
private static final String OPENID_CONNECT_ADD_USERSTORE_DOMAIN_TO_ID_TOKEN = "AddUserstoreDomainToIdToken";
// Enable/Disable adding domain information to the token.
private static final String ADD_DOMAIN_TO_ACCESS_TOKEN = "AddTenantDomainToAccessToken";
private static final String REQUEST_OBJECT_ENABLED = "RequestObjectEnabled";
private static final String ENABLE_FAPI_CIBA_PROFILE = "EnableCibaProfile";
private static final String ENABLE_FAPI_SECURITY_PROFILE = "EnableSecurityProfile";
Expand Down
8 changes: 8 additions & 0 deletions ...on.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,8 @@ public class JWTTokenIssuer extends OauthTokenIssuerImpl {

private static final String AUTHORIZATION_PARTY = "azp";
private static final String CLIENT_ID = "client_id";
private static final String APP_DOMAIN = "app_td";
private static final String USER_DOMAIN = "user_td";
private static final String AUDIENCE = "aud";
private static final String SCOPE = "scope";
private static final String TOKEN_BINDING_REF = "binding_ref";
Expand Down Expand Up @@ -494,6 +496,12 @@ protected JWTClaimsSet createJWTClaimSet(OAuthAuthzReqMessageContext authAuthzRe
jwtClaimsSetBuilder.jwtID(UUID.randomUUID().toString());
jwtClaimsSetBuilder.notBeforeTime(new Date(curTimeInMillis));
jwtClaimsSetBuilder.claim(CLIENT_ID, consumerKey);

if (OAuthServerConfiguration.getInstance().isAddTenantDomainToAccessTokenEnabled()) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets have a unit test covering this

jwtClaimsSetBuilder.claim(APP_DOMAIN, oAuthAppDO.getAppOwner().getTenantDomain());
jwtClaimsSetBuilder.claim(USER_DOMAIN, authenticatedUser.getTenantDomain());
}

setClaimsForNonPersistence(jwtClaimsSetBuilder, authAuthzReqMessageContext, tokenReqMessageContext,
authenticatedUser, oAuthAppDO);
String scope = getScope(authAuthzReqMessageContext, tokenReqMessageContext);
Expand Down
Loading