Use DELEGATING_ACTOR constant and support audince parameter in token request to support multiple audiences in single audience claim#3029
Open
Bin4yi wants to merge 2 commits intowso2-extensions:masterfrom
Conversation
…ces in single audience claim
|
|
![wso2-engineering[bot]](https://avatars.githubusercontent.com/in/1856828?s=60&v=4){kind=small}
Comment on lines
+305
to
+308
| // Set explicitly requested audiences first (if present) | ||
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | ||
| jwtClaimsSetBuilder.audience(request.getAudiences()); | ||
| } |
Contributor
There was a problem hiding this comment.
Log Improvement Suggestion No: 1
Suggested change
| // Set explicitly requested audiences first (if present) | |
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | |
| jwtClaimsSetBuilder.audience(request.getAudiences()); | |
| } | |
| // Set explicitly requested audiences first (if present) | |
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | |
| if (log.isDebugEnabled()) { | |
| log.debug("Setting explicitly requested audiences for client: " + request.getClientId() + ", audience count: " + request.getAudiences().size()); | |
| } | |
| jwtClaimsSetBuilder.audience(request.getAudiences()); | |
| } |
Comment on lines
+346
to
+349
| // Set explicitly requested audiences first (if present) | ||
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | ||
| jwtClaimsSetBuilder.audience(request.getAudiences()); | ||
| } |
Contributor
There was a problem hiding this comment.
Log Improvement Suggestion No: 2
Suggested change
| // Set explicitly requested audiences first (if present) | |
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | |
| jwtClaimsSetBuilder.audience(request.getAudiences()); | |
| } | |
| // Set explicitly requested audiences first (if present) | |
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | |
| if (log.isDebugEnabled()) { | |
| log.debug("Setting explicitly requested audiences for consumer: " + request.getConsumerKey() + ", audience count: " + request.getAudiences().size()); | |
| } | |
| jwtClaimsSetBuilder.audience(request.getAudiences()); | |
| } |
Comment on lines
+662
to
+665
| // Only set default audiences if not already specified by grant handler | ||
| if (tokReqMsgCtx.getAudiences() == null || tokReqMsgCtx.getAudiences().isEmpty()) { | ||
| tokReqMsgCtx.setAudiences(OAuth2Util.getOIDCAudience(consumerKey, oAuthAppBean)); | ||
| } |
Contributor
There was a problem hiding this comment.
Log Improvement Suggestion No: 3
Suggested change
| // Only set default audiences if not already specified by grant handler | |
| if (tokReqMsgCtx.getAudiences() == null || tokReqMsgCtx.getAudiences().isEmpty()) { | |
| tokReqMsgCtx.setAudiences(OAuth2Util.getOIDCAudience(consumerKey, oAuthAppBean)); | |
| } | |
| // Only set default audiences if not already specified by grant handler | |
| if (tokReqMsgCtx.getAudiences() == null || tokReqMsgCtx.getAudiences().isEmpty()) { | |
| if (log.isDebugEnabled()) { | |
| log.debug("No audiences specified by grant handler, setting default OIDC audiences for client: " + consumerKey); | |
| } | |
| tokReqMsgCtx.setAudiences(OAuth2Util.getOIDCAudience(consumerKey, oAuthAppBean)); | |
| } else { | |
| if (log.isDebugEnabled()) { | |
| log.debug("Using audiences specified by grant handler for client: " + consumerKey + ", audience count: " + tokReqMsgCtx.getAudiences().size()); | |
| } | |
| } |
Contributor
There was a problem hiding this comment.
AI Agent Log Improvement Checklist
- The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
- Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.
✅ Before merging this pull request:
- Review all AI-generated comments for accuracy and relevance.
- Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
| Comment | Accepted (Y/N) | Reason |
|---|---|---|
| #### Log Improvement Suggestion No: 1 | ||
| #### Log Improvement Suggestion No: 2 | ||
| #### Log Improvement Suggestion No: 3 |
📝 WalkthroughWalkthroughThe changes introduce delegation support throughout the OAuth token processing pipeline by adding a new DELEGATING_ACTOR constant, delegation-related fields and methods to message context classes, and updating token issuers, claim providers, and grant handlers to recognize and propagate delegation actor information alongside existing impersonation support. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/AccessTokenIssuer.java (1)
628-628: Remove leftover review artifact comment.
// ADD THIS BLOCKshould not be committed in source.Proposed cleanup
- } else if (tokReqMsgCtx.isDelegationRequest()) { // ADD THIS BLOCK + } else if (tokReqMsgCtx.isDelegationRequest()) {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/AccessTokenIssuer.java` at line 628, In AccessTokenIssuer, remove the stray review artifact comment "// ADD THIS BLOCK" found in the else-if handling tokReqMsgCtx.isDelegationRequest() so the code contains only the conditional block; locate the occurrence in the AccessTokenIssuer class (the else if (tokReqMsgCtx.isDelegationRequest()) line) and delete the comment text, keeping the conditional and its logic intact and formatted consistently with surrounding code.components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.java (1)
626-630: Add a null guard before convertingDELEGATING_ACTORto string.Line 628 can throw
NullPointerExceptionif delegation is marked but the property is absent.Proposed hardening
- if (tokReqMsgCtx.isDelegationRequest()) { + if (tokReqMsgCtx.isDelegationRequest() && tokReqMsgCtx.getProperty(DELEGATING_ACTOR) != null) { accessTokenExtendedAttributes = addExtendedAttribute(DELEGATING_ACTOR, tokReqMsgCtx.getProperty(DELEGATING_ACTOR).toString(), accessTokenExtendedAttributes); }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.java` around lines 626 - 630, The code calls tokReqMsgCtx.getProperty(DELEGATING_ACTOR).toString() without checking for null, which can NPE when isDelegationRequest() is true but the property is missing; update the block in AbstractAuthorizationGrantHandler so you retrieve the property via tokReqMsgCtx.getProperty(DELEGATING_ACTOR), check it for null (or instanceof String) before calling toString(), and only call addExtendedAttribute(DELEGATING_ACTOR, value, accessTokenExtendedAttributes) when a non-null/value is present; reference tokReqMsgCtx, isDelegationRequest(), getProperty(DELEGATING_ACTOR), addExtendedAttribute and accessTokenExtendedAttributes when making the change.components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/bindings/handlers/TokenBindingExpiryEventHandler.java (1)
380-394: Consolidate actor validation helpers to avoid logic drift.Line 380 introduces logic that mirrors the existing impersonation validator. A shared helper would keep future actor-type changes consistent.
♻️ Suggested refactor
private boolean validateImpersonatingActorInitiatedRevocation( AccessTokenDO accessTokenDO, String authenticatedSubjectIdentifier) { - - boolean isImpersonationRequest = accessTokenDO.getAccessTokenExtendedAttributes() != null && - accessTokenDO.getAccessTokenExtendedAttributes().getParameters() != null && - accessTokenDO.getAccessTokenExtendedAttributes().getParameters().containsKey(IMPERSONATING_ACTOR); - if (isImpersonationRequest) { - return Objects.equals(accessTokenDO.getAccessTokenExtendedAttributes() - .getParameters().get(IMPERSONATING_ACTOR), authenticatedSubjectIdentifier); - } - return false; + return validateActorInitiatedRevocation(accessTokenDO, authenticatedSubjectIdentifier, IMPERSONATING_ACTOR); } private boolean validateDelegatingActorInitiatedRevocation( AccessTokenDO accessTokenDO, String authenticatedSubjectIdentifier) { - - boolean isDelegationRequest = accessTokenDO.getAccessTokenExtendedAttributes() != null && - accessTokenDO.getAccessTokenExtendedAttributes().getParameters() != null && - accessTokenDO.getAccessTokenExtendedAttributes().getParameters() - .containsKey(DELEGATING_ACTOR); - if (isDelegationRequest) { - return Objects.equals( - accessTokenDO.getAccessTokenExtendedAttributes() - .getParameters().get(DELEGATING_ACTOR), - authenticatedSubjectIdentifier); - } - return false; + return validateActorInitiatedRevocation(accessTokenDO, authenticatedSubjectIdentifier, DELEGATING_ACTOR); +} + +private boolean validateActorInitiatedRevocation(AccessTokenDO accessTokenDO, + String authenticatedSubjectIdentifier, + String actorKey) { + return accessTokenDO.getAccessTokenExtendedAttributes() != null + && accessTokenDO.getAccessTokenExtendedAttributes().getParameters() != null + && accessTokenDO.getAccessTokenExtendedAttributes().getParameters().containsKey(actorKey) + && Objects.equals(accessTokenDO.getAccessTokenExtendedAttributes() + .getParameters().get(actorKey), authenticatedSubjectIdentifier); }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/bindings/handlers/TokenBindingExpiryEventHandler.java` around lines 380 - 394, The new validateDelegatingActorInitiatedRevocation duplicates actor-validation logic; refactor by extracting the common null-and-parameter-check into a shared helper (e.g., validateActorInitiatedRevocation(AccessTokenDO accessTokenDO, String actorKey, String authenticatedSubjectIdentifier)) and replace validateDelegatingActorInitiatedRevocation with a one-line call to that helper using DELEGATING_ACTOR, then update any existing impersonation validator to call the same helper so both actor types use the identical validation path; ensure the helper checks accessTokenDO.getAccessTokenExtendedAttributes(), its getParameters(), presence of actorKey, and equality against authenticatedSubjectIdentifier.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandler.java`:
- Around line 326-337: In propagateActorInfo, guard the parameters map returned
by
tokenReqMessageContext.getOauth2AccessTokenReqDTO().getAccessTokenExtendedAttributes().getParameters()
before using it: check whether the params map is null and return early (or skip
actor extraction) if so, then proceed to read OAuthConstants.IMPERSONATING_ACTOR
and call StringUtils.isNotBlank on the retrieved value; this prevents an NPE
when extended attributes exist but their parameters map is absent.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java`:
- Around line 305-312: The explicit audience set via request.getAudiences() is
being overwritten by the scope-based fallback; update the logic in
JWTTokenIssuer so the scope-based jwtClaimsSetBuilder.audience(...) is only
applied when no explicit audiences were provided (i.e., when
request.getAudiences() is null or empty). Concretely, change the condition
around the scope check that uses request.getScope() and AUDIENCE to first verify
request.getAudiences() is null or empty before calling
jwtClaimsSetBuilder.audience(...); apply the same guarded check in the other
similar block handling audiences (the repeated lines referencing
jwtClaimsSetBuilder.audience and request.getScope()).
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.java`:
- Around line 223-226: The setter setDelegationRequest is assigning the wrong
field (it sets isImpersonationRequest instead of isDelegationRequest), so the
delegation flag never becomes true; update the method
setDelegationRequest(boolean delegationRequest) to assign the value to
isDelegationRequest (not isImpersonationRequest) so that isDelegationRequest()
reflects the passed value and delegation flow works correctly.
---
Nitpick comments:
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/AccessTokenIssuer.java`:
- Line 628: In AccessTokenIssuer, remove the stray review artifact comment "//
ADD THIS BLOCK" found in the else-if handling tokReqMsgCtx.isDelegationRequest()
so the code contains only the conditional block; locate the occurrence in the
AccessTokenIssuer class (the else if (tokReqMsgCtx.isDelegationRequest()) line)
and delete the comment text, keeping the conditional and its logic intact and
formatted consistently with surrounding code.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/bindings/handlers/TokenBindingExpiryEventHandler.java`:
- Around line 380-394: The new validateDelegatingActorInitiatedRevocation
duplicates actor-validation logic; refactor by extracting the common
null-and-parameter-check into a shared helper (e.g.,
validateActorInitiatedRevocation(AccessTokenDO accessTokenDO, String actorKey,
String authenticatedSubjectIdentifier)) and replace
validateDelegatingActorInitiatedRevocation with a one-line call to that helper
using DELEGATING_ACTOR, then update any existing impersonation validator to call
the same helper so both actor types use the identical validation path; ensure
the helper checks accessTokenDO.getAccessTokenExtendedAttributes(), its
getParameters(), presence of actorKey, and equality against
authenticatedSubjectIdentifier.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.java`:
- Around line 626-630: The code calls
tokReqMsgCtx.getProperty(DELEGATING_ACTOR).toString() without checking for null,
which can NPE when isDelegationRequest() is true but the property is missing;
update the block in AbstractAuthorizationGrantHandler so you retrieve the
property via tokReqMsgCtx.getProperty(DELEGATING_ACTOR), check it for null (or
instanceof String) before calling toString(), and only call
addExtendedAttribute(DELEGATING_ACTOR, value, accessTokenExtendedAttributes)
when a non-null/value is present; reference tokReqMsgCtx, isDelegationRequest(),
getProperty(DELEGATING_ACTOR), addExtendedAttribute and
accessTokenExtendedAttributes when making the change.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e2b5f4d4-0ae1-451b-987d-3bc29f7e5fd5
📒 Files selected for processing (9)
components/org.wso2.carbon.identity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/authz/OAuthAuthzReqMessageContext.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/AccessTokenIssuer.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/bindings/handlers/TokenBindingExpiryEventHandler.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/claims/DelegatedAccessTokenClaimProvider.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.javacomponents/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandler.java
Comment on lines
+326
to
+337
| private void propagateActorInfo(OAuthTokenReqMessageContext tokenReqMessageContext) { | ||
|
|
||
| log.debug("Checking for actor information in token request"); | ||
| if (tokenReqMessageContext == null || tokenReqMessageContext.getOauth2AccessTokenReqDTO() == null || | ||
| tokenReqMessageContext.getOauth2AccessTokenReqDTO().getAccessTokenExtendedAttributes() == null) { | ||
| return; | ||
| } | ||
|
|
||
| Map<String, String> params = tokenReqMessageContext.getOauth2AccessTokenReqDTO().getAccessTokenExtendedAttributes().getParameters(); | ||
|
|
||
| String impersonator = params.get(OAuthConstants.IMPERSONATING_ACTOR); | ||
| if (StringUtils.isNotBlank(impersonator)) { |
There was a problem hiding this comment.
Guard parameters before actor extraction to prevent NPEs.
On Line 334, getParameters() is used without a null check, and Line 336 dereferences it immediately. This can break refresh token issuance when extended attributes exist but their parameter map is absent.
🛠️ Suggested fix
private void propagateActorInfo(OAuthTokenReqMessageContext tokenReqMessageContext) {
@@
- Map<String, String> params = tokenReqMessageContext.getOauth2AccessTokenReqDTO().getAccessTokenExtendedAttributes().getParameters();
+ Map<String, String> params = tokenReqMessageContext.getOauth2AccessTokenReqDTO()
+ .getAccessTokenExtendedAttributes().getParameters();
+ if (params == null || params.isEmpty()) {
+ return;
+ }
String impersonator = params.get(OAuthConstants.IMPERSONATING_ACTOR);🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandler.java`
around lines 326 - 337, In propagateActorInfo, guard the parameters map returned
by
tokenReqMessageContext.getOauth2AccessTokenReqDTO().getAccessTokenExtendedAttributes().getParameters()
before using it: check whether the params map is null and return early (or skip
actor extraction) if so, then proceed to read OAuthConstants.IMPERSONATING_ACTOR
and call StringUtils.isNotBlank on the retrieved value; this prevents an NPE
when extended attributes exist but their parameters map is absent.
Comment on lines
+305
to
312
| // Set explicitly requested audiences first (if present) | ||
| if (request.getAudiences() != null && !request.getAudiences().isEmpty()) { | ||
| jwtClaimsSetBuilder.audience(request.getAudiences()); | ||
| } | ||
|
|
||
| if (request.getScope() != null && Arrays.asList((request.getScope())).contains(AUDIENCE)) { | ||
| jwtClaimsSetBuilder.audience(Arrays.asList(request.getScope())); | ||
| } |
There was a problem hiding this comment.
Explicit audiences can be overwritten by scope-based fallback.
At Line 310 and Line 351, the scope-based audience(...) call can overwrite the explicit audiences set at Line 306-307 and Line 347-348. This breaks the “prefer requested audiences” behavior.
Proposed fix
- // Set explicitly requested audiences first (if present)
- if (request.getAudiences() != null && !request.getAudiences().isEmpty()) {
- jwtClaimsSetBuilder.audience(request.getAudiences());
- }
-
- if (request.getScope() != null && Arrays.asList((request.getScope())).contains(AUDIENCE)) {
+ boolean hasExplicitAudiences = request.getAudiences() != null && !request.getAudiences().isEmpty();
+ if (hasExplicitAudiences) {
+ jwtClaimsSetBuilder.audience(request.getAudiences());
+ } else if (request.getScope() != null && Arrays.asList((request.getScope())).contains(AUDIENCE)) {
jwtClaimsSetBuilder.audience(Arrays.asList(request.getScope()));
}- // Set explicitly requested audiences first (if present)
- if (request.getAudiences() != null && !request.getAudiences().isEmpty()) {
- jwtClaimsSetBuilder.audience(request.getAudiences());
- }
-
- if (request.getApprovedScope() != null && Arrays.asList((request.getApprovedScope())).contains(AUDIENCE)) {
+ boolean hasExplicitAudiences = request.getAudiences() != null && !request.getAudiences().isEmpty();
+ if (hasExplicitAudiences) {
+ jwtClaimsSetBuilder.audience(request.getAudiences());
+ } else if (request.getApprovedScope() != null
+ && Arrays.asList((request.getApprovedScope())).contains(AUDIENCE)) {
jwtClaimsSetBuilder.audience(Arrays.asList(request.getApprovedScope()));
}Also applies to: 346-353
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java`
around lines 305 - 312, The explicit audience set via request.getAudiences() is
being overwritten by the scope-based fallback; update the logic in
JWTTokenIssuer so the scope-based jwtClaimsSetBuilder.audience(...) is only
applied when no explicit audiences were provided (i.e., when
request.getAudiences() is null or empty). Concretely, change the condition
around the scope check that uses request.getScope() and AUDIENCE to first verify
request.getAudiences() is null or empty before calling
jwtClaimsSetBuilder.audience(...); apply the same guarded check in the other
similar block handling audiences (the repeated lines referencing
jwtClaimsSetBuilder.audience and request.getScope()).
Comment on lines
+223
to
+226
| public void setDelegationRequest(boolean delegationRequest) { | ||
|
|
||
| isImpersonationRequest = delegationRequest; | ||
| } |
There was a problem hiding this comment.
Setter updates the wrong flag (delegation never becomes true).
setDelegationRequest currently assigns isImpersonationRequest, so isDelegationRequest() remains false and delegation flow logic breaks.
Proposed fix
public void setDelegationRequest(boolean delegationRequest) {
-
- isImpersonationRequest = delegationRequest;
+ isDelegationRequest = delegationRequest;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| public void setDelegationRequest(boolean delegationRequest) { | |
| isImpersonationRequest = delegationRequest; | |
| } | |
| public void setDelegationRequest(boolean delegationRequest) { | |
| isDelegationRequest = delegationRequest; | |
| } |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/OAuthTokenReqMessageContext.java`
around lines 223 - 226, The setter setDelegationRequest is assigning the wrong
field (it sets isImpersonationRequest instead of isDelegationRequest), so the
delegation flag never becomes true; update the method
setDelegationRequest(boolean delegationRequest) to assign the value to
isDelegationRequest (not isImpersonationRequest) so that isDelegationRequest()
reflects the passed value and delegation flow works correctly.
Bin4yi
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes in this pull request
Introduced DELEGATING_ACTOR constant
OAuthAuthzMessageConext.java
AbstractAuthorizationGrantHandler.java
JWTTokenIssuer.java
When should this PR be merged
[Please describe any preconditions that need to be addressed before we
can merge this pull request.]
Follow up actions
[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]
Developer Checklist (Mandatory)
product-isissue to track any behavioral change or migration impact.Checklist (for reviewing)
General
Functionality
Code
Tests
Security
Documentation
Summary by CodeRabbit
Release Notes
New Features
Bug Fixes