Add Support nested act claim with azp and multi-audience in token request#3028
Open
Bin4yi wants to merge 23 commits intowso2-extensions:masterfrom
Open
Add Support nested act claim with azp and multi-audience in token request#3028Bin4yi wants to merge 23 commits intowso2-extensions:masterfrom
Bin4yi wants to merge 23 commits intowso2-extensions:masterfrom
Conversation
|
|
...ava/org/wso2/carbon/identity/oauth2/token/handlers/claims/AgentAccessTokenClaimProvider.java
Outdated
Show resolved
Hide resolved
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
Outdated
Show resolved
Hide resolved
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
Outdated
Show resolved
Hide resolved
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
Outdated
Show resolved
Hide resolved
piraveena
reviewed
Mar 10, 2026
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Outdated
Show resolved
Hide resolved
Thumimku
reviewed
Mar 10, 2026
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Outdated
Show resolved
Hide resolved
...java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Outdated
Show resolved
Hide resolved
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
Outdated
Show resolved
Hide resolved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds delegation support across OAuth flows: new constants, delegation flags/properties on authz/token contexts, audience passthrough, construction of "act" claims (including nested/chained delegation), propagation/storage of a delegating actor in token attributes, token-revocation updates, a new DelegatedAccessTokenClaimProvider, and related unit tests. Changes
Sequence DiagramsequenceDiagram
participant Client
participant AuthzHandler as AuthorizationCodeGrantHandler
participant TokenCtx as OAuthTokenReqMessageContext
participant GrantHandler as Refresh/GrantHandler
participant JWTIssuer as JWTTokenIssuer
participant ClaimProvider as Delegated/AgentClaimProvider
Client->>AuthzHandler: submit authorization / actor token
AuthzHandler->>AuthzHandler: extract actor sub, azp, existing act
AuthzHandler->>TokenCtx: set IS_DELEGATION_REQUEST, ACTOR_SUBJECT, ACTOR_AZP, EXISTING_ACT_CLAIM
Client->>GrantHandler: token request
GrantHandler->>GrantHandler: propagate actor info -> set DELEGATING_ACTOR attr
GrantHandler->>JWTIssuer: createJWTClaimSet(tokenReqCtx)
rect rgba(100,150,200,0.5)
JWTIssuer->>JWTIssuer: if isDelegationRequest build "act" claim (sub, azp, nest existing act)
JWTIssuer->>JWTIssuer: set audience from request.getAudiences() if present
end
JWTIssuer->>ClaimProvider: getAdditionalClaims(tokenCtx)
ClaimProvider->>ClaimProvider: provide act claim for access token if delegation present
ClaimProvider-->>Client: return enriched token / JWT
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/AgentAccessTokenClaimProvider.java`:
- Around line 14-15: The provider overwrites any existing nested delegation
chain by replacing the act claim with a flat {sub, azp} when
AgentAccessTokenClaimProvider applies provider claims; update
AgentAccessTokenClaimProvider (the branch handling ACTOR_AZP/ACTOR_* in
buildJWTToken flow) to merge with an existing act claim instead of replacing it:
detect EXISTING_ACT_CLAIM built by JWTTokenIssuer.createJWTClaimSet(..),
preserve nested act entries and append/merge the new actor (azp/sub) into the
existing structure rather than clobbering it, and add a regression test that
issues an actor token already containing an act claim and asserts the nested
delegation chain is retained; apply the same fix to the other similar branch
(lines referenced as 42-60) to ensure consistency.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b890f506-69a7-4411-9044-8c5f29bb6d14
📒 Files selected for processing (4)
components/org.wso2.carbon.identity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/AgentAccessTokenClaimProvider.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Comment on lines
+14
to
+15
| import static org.wso2.carbon.identity.oauth.common.OAuthConstants.ACTOR_AZP; | ||
|
|
There was a problem hiding this comment.
This branch overwrites the nested delegation chain.
JWTTokenIssuer.createJWTClaimSet(..) already builds the delegation act claim from ACTOR_* plus EXISTING_ACT_CLAIM. Because provider claims are applied afterward in buildJWTToken(..), this branch replaces it with a flat {sub, azp} and drops any incoming nested act. Please add a regression test with an actor token that already contains act.
🛠️ Minimal fix
import static org.wso2.carbon.identity.oauth.common.OAuthConstants.ACTOR_AZP;
+import static org.wso2.carbon.identity.oauth.common.OAuthConstants.IS_DELEGATION_REQUEST;
@@
- } else if (GrantType.AUTHORIZATION_CODE.toString().equals(context.getOauth2AccessTokenReqDTO().getGrantType())
- && context.getRequestedActor() != null) {
+ } else if (GrantType.AUTHORIZATION_CODE.toString().equals(context.getOauth2AccessTokenReqDTO().getGrantType())
+ && context.getRequestedActor() != null
+ && !Boolean.TRUE.equals(context.getProperty(IS_DELEGATION_REQUEST))) {Also applies to: 42-60
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/AgentAccessTokenClaimProvider.java`
around lines 14 - 15, The provider overwrites any existing nested delegation
chain by replacing the act claim with a flat {sub, azp} when
AgentAccessTokenClaimProvider applies provider claims; update
AgentAccessTokenClaimProvider (the branch handling ACTOR_AZP/ACTOR_* in
buildJWTToken flow) to merge with an existing act claim instead of replacing it:
detect EXISTING_ACT_CLAIM built by JWTTokenIssuer.createJWTClaimSet(..),
preserve nested act entries and append/merge the new actor (azp/sub) into the
existing structure rather than clobbering it, and add a regression test that
issues an actor token already containing an act claim and asserts the nested
delegation chain is retained; apply the same fix to the other similar branch
(lines referenced as 42-60) to ensure consistency.
...on.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/AccessTokenIssuer.java
Outdated
Show resolved
Hide resolved
Co-authored-by: Pavindu Lakshan <pavindulakshan@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/DelegatedAccessTokenClaimProvider.java`:
- Around line 35-41: DelegatedAccessTokenClaimProvider is defined but not
registered and will conflict with JWTTokenIssuer's existing delegation handling
by emitting a flat act claim; either remove this provider, register and
integrate it properly, or disable its act emission so only JWTTokenIssuer builds
nested act structures. Specifically, either delete or unregister
DelegatedAccessTokenClaimProvider (to match how
ImpersonatedAccessTokenClaimProvider and AgentAccessTokenClaimProvider are
registered in OAuth2ServiceComponent), or modify
DelegatedAccessTokenClaimProvider so it consults EXISTING_ACT_CLAIM and defers
to JWTTokenIssuer's logic (lines handling DELEGATING_ACT and ACT) rather than
returning a standalone act:{sub:...} map; ensure only JWTTokenIssuer constructs
the nested act/azp chain to avoid duplicate act claim emission.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.java`:
- Around line 223-226: Setter setDelegationRequest currently assigns the value
to isImpersonationRequest instead of the delegation flag; change the method
(setDelegationRequest) to set the isDelegationRequest field to the passed
delegationRequest value (do not flip isImpersonationRequest), so downstream
checks like isDelegationRequest() and isImpersonationRequest() behave correctly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a1d3f1d0-a22d-444e-93d2-a4aa85b56e75
📒 Files selected for processing (9)
components/org.wso2.carbon.identity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/authz/OAuthAuthzReqMessageContext.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/AccessTokenIssuer.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/bindings/handlers/TokenBindingExpiryEventHandler.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/DelegatedAccessTokenClaimProvider.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandler.java
🚧 Files skipped from review as they are similar to previous changes (2)
- components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
- components/org.wso2.carbon.identity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.java
Comment on lines
+35
to
+41
| if (context.isDelegationRequest() | ||
| && context.getProperty(DELEGATING_ACTOR) != null | ||
| && StringUtils.isNotBlank(context.getProperty(DELEGATING_ACTOR).toString())) { | ||
|
|
||
| Map<String, Object> actorMap = new HashMap<>(); | ||
| actorMap.put(ACT, Collections.singletonMap(SUB, context.getProperty(DELEGATING_ACTOR).toString())); | ||
| return actorMap; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show where JWT access-token claim providers are discovered and used.
rg -n -C3 --type=java 'JWTAccessTokenClaimProvider|DelegatedAccessTokenClaimProvider|getAdditionalClaims\('
printf '\n--- JWTTokenIssuer.java ---\n'
fd 'JWTTokenIssuer.java' -x sed -n '1,320p' {}
printf '\n--- act/azp handling ---\n'
rg -n -C3 --type=java 'DELEGATING_ACTOR|ACTOR_AZP|EXISTING_ACT|\bact\b|\bazp\b'Repository: wso2-extensions/identity-inbound-auth-oauth
Length of output: 50400
🏁 Script executed:
#!/bin/bash
# Find and show JWTTokenIssuer.java - look for claim merging logic
fd 'JWTTokenIssuer.java' --type f ! -path '*/test/*' -x cat {} | head -400
# Look for setAdditionalClaimSet and related merge logic
echo -e '\n--- Claim merge method ---'
rg -n 'setAdditionalClaimSet|mergeAdditional|getAdditionalClaims' --type=java -A5 components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
# Check how providers are registered and called
echo -e '\n--- Provider registration and call sites ---'
rg -n 'getJWTAccessTokenClaimProvider|addJWTAccessTokenClaimProvider' --type=java components/org.wso2.carbon.identity.oauth/src/main/java/ -B2 -A2
# Look for act claim specific handling
echo -e '\n--- ACT claim handling in JWTTokenIssuer ---'
rg -n '"act"|ACT' --type=java components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java -B3 -A3Repository: wso2-extensions/identity-inbound-auth-oauth
Length of output: 11453
🏁 Script executed:
#!/bin/bash
# Search for where DelegatedAccessTokenClaimProvider is instantiated/registered in production
echo "=== DelegatedAccessTokenClaimProvider registration ==="
rg -n 'new DelegatedAccessTokenClaimProvider|DelegatedAccessTokenClaimProvider' \
--type=java components/org.wso2.carbon.identity.oauth/src/main/java/ -B2 -A2
# Check component activator/descriptor files
echo -e '\n=== Component descriptors ==='
find components/org.wso2.carbon.identity.oauth/src/main -name '*.xml' -o -name 'component.properties' | head -10
# Search for META-INF ServiceLoader config
echo -e '\n=== ServiceLoader configs ==='
find components/org.wso2.carbon.identity.oauth -path '*/META-INF/services/*' -type f 2>/dev/null | xargs cat 2>/dev/null | grep -i 'delegated\|claim'
# Show how other providers (ImpersonatedAccessTokenClaimProvider, AgentAccessTokenClaimProvider) are registered
echo -e '\n=== ImpersonatedAccessTokenClaimProvider registration ==='
rg -n 'ImpersonatedAccessTokenClaimProvider' --type=java components/org.wso2.carbon.identity.oauth/src/main/java/ -B1 -A1 | head -20Repository: wso2-extensions/identity-inbound-auth-oauth
Length of output: 3337
🏁 Script executed:
#!/bin/bash
# Check OAuth2ServiceComponent for DelegatedAccessTokenClaimProvider registration
echo "=== OAuth2ServiceComponent for DelegatedAccessTokenClaimProvider ==="
rg -n 'DelegatedAccessTokenClaimProvider' components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponent.java -B5 -A5
# Show the full registration section
echo -e '\n=== Full provider registration section ==='
sed -n '285,295p' components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponent.java
# Also check imports in OAuth2ServiceComponent
echo -e '\n=== Imports around claim providers ==='
rg -n 'import.*AccessTokenClaimProvider' components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponent.javaRepository: wso2-extensions/identity-inbound-auth-oauth
Length of output: 1333
🏁 Script executed:
#!/bin/bash
# Search for tests using DelegatedAccessTokenClaimProvider
echo "=== Test files for DelegatedAccessTokenClaimProvider ==="
find components/org.wso2.carbon.identity.oauth -name '*DelegatedAccessTokenClaimProvider*' -type f
# Check if there's a test and what it does
echo -e '\n=== DelegatedAccessTokenClaimProvider Test ==='
find components/org.wso2.carbon.identity.oauth -name '*DelegatedAccessTokenClaimProvider*Test*' -type f -exec cat {} \;
# Look for any TODO/FIXME comments near delegation or act claims
echo -e '\n=== TODO/FIXME around delegation ==='
rg -n 'TODO|FIXME' --type=java components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/
# Look for any comment explaining delegation flow
echo -e '\n=== Comments about delegation in DelegatedAccessTokenClaimProvider ==='
sed -n '1,60p' components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/DelegatedAccessTokenClaimProvider.javaRepository: wso2-extensions/identity-inbound-auth-oauth
Length of output: 2086
DelegatedAccessTokenClaimProvider is not registered and conflicts with JWTTokenIssuer's delegation handling.
This provider is defined but never instantiated (unlike ImpersonatedAccessTokenClaimProvider and AgentAccessTokenClaimProvider, which are registered in OAuth2ServiceComponent lines 288-291). When examined, JWTTokenIssuer already provides dedicated delegation act claim handling (lines 741–787) that correctly builds nested act structures with azp and chains via EXISTING_ACT_CLAIM.
If this provider is intended to be wired, it will emit a flat act: {sub: ...} structure that conflicts with JWTTokenIssuer's superior nested handling. Either remove the provider as unnecessary, register it with proper integration into JWTTokenIssuer's delegation logic, or clarify its intended activation point. Do not emit act claims from multiple independent paths.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/DelegatedAccessTokenClaimProvider.java`
around lines 35 - 41, DelegatedAccessTokenClaimProvider is defined but not
registered and will conflict with JWTTokenIssuer's existing delegation handling
by emitting a flat act claim; either remove this provider, register and
integrate it properly, or disable its act emission so only JWTTokenIssuer builds
nested act structures. Specifically, either delete or unregister
DelegatedAccessTokenClaimProvider (to match how
ImpersonatedAccessTokenClaimProvider and AgentAccessTokenClaimProvider are
registered in OAuth2ServiceComponent), or modify
DelegatedAccessTokenClaimProvider so it consults EXISTING_ACT_CLAIM and defers
to JWTTokenIssuer's logic (lines handling DELEGATING_ACT and ACT) rather than
returning a standalone act:{sub:...} map; ensure only JWTTokenIssuer constructs
the nested act/azp chain to avoid duplicate act claim emission.
...y.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.java
Show resolved
Hide resolved
Bin4yi
changed the title
There was a problem hiding this comment.
🧹 Nitpick comments (1)
components/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuerTest.java (1)
657-660: Strengthen chained-delegation assertion with nested claim content checks.At Line 658, the test currently checks only nested
actpresence. Assert nestedsub/azpvalues as well to catch mapping regressions.Suggested test hardening
if (expectNestedAct) { assertNotNull(actClaim.get("act"), "Nested act claim should be present for chained delegation"); + Map<String, Object> nestedAct = (Map<String, Object>) actClaim.get("act"); + assertEquals(nestedAct.get("sub"), "previous-actor", + "Nested act.sub should preserve prior actor subject"); + assertEquals(nestedAct.get("azp"), "previous-azp", + "Nested act.azp should preserve prior actor azp"); } else { assertNull(actClaim.get("act"), "No nested act claim expected"); }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@components/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuerTest.java` around lines 657 - 660, The chained-delegation test should not only assert presence of the nested "act" claim but also verify its contents: when expectNestedAct is true, obtain the nested map (Object nestedAct = actClaim.get("act")) and assert its "sub" and "azp" entries equal the expected delegated subject and client id used earlier in the test (e.g., the variables representing the delegated subject and authorized party), likewise keep the existing assertNull branch for when expectNestedAct is false; update JWTTokenIssuerTest to add these assertEquals checks against the expected values so mapping regressions are detected.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In
`@components/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuerTest.java`:
- Around line 657-660: The chained-delegation test should not only assert
presence of the nested "act" claim but also verify its contents: when
expectNestedAct is true, obtain the nested map (Object nestedAct =
actClaim.get("act")) and assert its "sub" and "azp" entries equal the expected
delegated subject and client id used earlier in the test (e.g., the variables
representing the delegated subject and authorized party), likewise keep the
existing assertNull branch for when expectNestedAct is false; update
JWTTokenIssuerTest to add these assertEquals checks against the expected values
so mapping regressions are detected.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e1434530-05ac-4760-81e2-e6e82b3b2797
📒 Files selected for processing (5)
components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuerTest.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/DelegatedAccessTokenClaimProviderTest.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandlerTest.javacomponents/org.wso2.carbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandlerTest.java
🚧 Files skipped from review as they are similar to previous changes (1)
- components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.java
# Conflicts: # components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/authz/OAuthAuthzReqMessageContext.java # components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/AgentAccessTokenClaimProvider.java # components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/ActorTokenValidator.java # components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AuthorizationCodeGrantHandler.java
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #3028 +/- ##
============================================
- Coverage 59.70% 57.25% -2.46%
- Complexity 10162 10731 +569
============================================
Files 708 709 +1
Lines 55447 61504 +6057
Branches 13134 14893 +1759
============================================
+ Hits 33104 35213 +2109
- Misses 17993 21525 +3532
- Partials 4350 4766 +416
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes in this pull request
OAuthConstants.javaACTOR_AZP,IS_DELEGATION_REQUEST,ACTOR_SUBJECT,EXISTING_ACT_CLAIM, andDELEGATING_ACTOROAuthAuthzReqMessageContext.javaaudiencesfield with getter and setter to support explicit audience specification in authorization requestsAbstractAuthorizationGrantHandler.javaupdateMessageContextToCreateNewToken(), default audiences are only set when not already specified by the grant handler (prevents overwriting explicitly requested audiences)getAccessTokenExtendedAttributes(), persistsDELEGATING_ACTORas an extended token attribute when the request is a delegation request — enables downstream propagation (e.g. refresh token flow, session-bound revocation)OAuthTokenReqMessageContext.javaisDelegationRequestboolean field withisDelegationRequest()getter andsetDelegationRequest()setter to distinguish delegation flows from impersonation flowsAuthorizationCodeGrantHandler.javaazpandactclaims from the actor token during token exchangeIS_DELEGATION_REQUEST,ACTOR_SUBJECT,ACTOR_AZP,EXISTING_ACT_CLAIM) on the token request context to drive act claim construction in the JWT issueractclaim from the actor token is preserved for chained delegation nestingJWTTokenIssuer.javabuildJWTToken()overloads — when audiences are already set on the context, they take precedence over the OIDC default audienceactclaim withsub(actor subject) and optionallyazp(actor authorized party)actclaim is present in the actor token, it is nested inside the newactclaimactclaim) does not add anyactclaimmay_actin the subject token — unaffectedAccessTokenIssuer.javadelegating_actorin the audit log alongside the existing impersonation loggingRefreshGrantHandler.javapropagateImpersonationInfo()topropagateActorInfo()to handle both impersonation and delegation flowsDELEGATING_ACTORfrom the stored extended attributes and propagates it back into the token request context so that refreshed tokens carry the correctactclaimTokenBindingExpiryEventHandler.javavalidateDelegatingActorInitiatedRevocation()— session-bound token revocation is now also triggered when the delegating actor terminates their session, mirroring the existing behaviour for impersonating actorsDelegatedAccessTokenClaimProvider.java(new)JWTAccessTokenClaimProviderimplementation for the delegation flowactclaim containing thesubof the delegating actor whenisDelegationRequestis true andDELEGATING_ACTORis setSample delegated access token (chained delegation):
{ "sub": "11111111-2222-3333-4444-555555555555", "aut": "APPLICATION_USER", "iss": "https://example.com/oauth2/token", "client_id": "client_ABC123XYZ", "aud": [ "client_ABC123XYZ", "aud_service_READ_001", "aud_service_WRITE_002" ], "nbf": 1770000000, "act": { "sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "act": { "sub": "ffffffff-1111-2222-3333-444444444444", "azp": "client_ABC123XYZ" }, "azp": "client_ABC123ABC" }, "azp": "client_ABC123ABC", "org_id": "org_00112233", "scope": "booking:read", "exp": 1770003600, "org_name": "ExampleOrg", "iat": 1770000000, "jti": "jwtid_9f8e7d6c5b4a", "org_handle": "example.org" }Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Checklist (for reviewing)
General
Functionality
Code
Tests
Security
Documentation
Summary by CodeRabbit