Default OAuth2 Scope Validator implementation #2206

shashimalcse · 2023-10-19T09:26:19Z

Proposed changes in this pull request

Scope validator implementation for Identity Server new authorization runtime.

Related Issues :

[Feature] Support application roles for Identity Server and support RBAC for apps wso2/product-is#16363

When should this PR be merged

[Please describe any preconditions that need to be addressed before we
can merge this pull request.]

Follow up actions

[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]

Checklist (for reviewing)

General

Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
Is the PR labeled correctly?

Functionality

Are all requirements met? Compare implemented functionality with the requirements specification.
Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
Are all UI and API inputs run through forms or serializers?
Are all external inputs validated and sanitized appropriately?
Does all branching logic have a default case?
Does this solution handle outliers and edge cases gracefully?
Are all external communications secured and restricted to SSL?

Documentation

Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

…cse/identity-inbound-auth-oauth into shashimalcse-patch-100

...ity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponent.java

...uth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponentHolder.java

...ava/org/wso2/carbon/identity/oauth2/validators/validationhandler/ScopeValidationContext.java

jenkins-is-staging · 2023-10-25T03:26:56Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/6635383674

jenkins-is-staging · 2023-10-25T03:44:45Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6635383674
Status: failure

jenkins-is-staging · 2023-10-25T04:17:16Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/6635682079

jenkins-is-staging · 2023-10-25T04:37:18Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6635682079
Status: failure

jenkins-is-staging · 2023-10-25T10:06:15Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/6638838320

jenkins-is-staging · 2023-10-25T14:02:26Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6638838320
Status: cancelled

jenkins-is-staging · 2023-10-26T07:25:35Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/6650828277

jenkins-is-staging · 2023-10-26T10:32:56Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6650828277
Status: failure

shashimalcse · 2023-10-26T11:10:56Z

PR builder have failed due to the :

 [ERROR] Failures: 
 [ERROR] org.wso2.identity.integration.test.scim2.SCIM2PaginationTestCase.testUserListingPagination(org.wso2.identity.integration.test.scim2.SCIM2PaginationTestCase)
 [ERROR] Run 1: SCIM2PaginationTestCase.testUserListingPagination:125->getCurrentUsersCount:282 » AxisFault
 [ERROR] Run 2: SCIM2PaginationTestCase.testUserListingPagination:125->getCurrentUsersCount:282 » AxisFault
 [INFO] 
 [ERROR] org.wso2.identity.integration.test.scim2.SCIM2PaginationTestCase.testUserListingPaginationWithoutParams(org.wso2.identity.integration.test.scim2.SCIM2PaginationTestCase)
 [ERROR] Run 1: SCIM2PaginationTestCase.testUserListingPaginationWithoutParams:157->getCurrentUsersCount:282 » AxisFault
 [ERROR] Run 2: SCIM2PaginationTestCase.testUserListingPaginationWithoutParams:157->getCurrentUsersCount:282 » AxisFault
 [INFO] 
 [ERROR] JDBCBasedUserMgtTestCase.testInit:39 » UserAdminUserAdmin UserAdminUserAdminEx...

Tested locally and build succeeded

AnuradhaSK · 2023-10-26T11:18:37Z

...uth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponentHolder.java

+    public APIResourceManager getApiResourceManager() {
+        return apiResourceManager;
+    }


Suggested change

public APIResourceManager getApiResourceManager() {

return apiResourceManager;

}

public APIResourceManager getApiResourceManager() {

return apiResourceManager;

}

AnuradhaSK · 2023-10-26T11:18:46Z

...uth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponentHolder.java

+    public void setApiResourceManager(APIResourceManager apiResourceManager) {
+        this.apiResourceManager = apiResourceManager;
+    }


Suggested change

public void setApiResourceManager(APIResourceManager apiResourceManager) {

this.apiResourceManager = apiResourceManager;

}

public void setApiResourceManager(APIResourceManager apiResourceManager) {

this.apiResourceManager = apiResourceManager;

}

AnuradhaSK · 2023-10-26T11:26:24Z

...arbon/identity/oauth2/validators/validationhandler/impl/RoleBasedScopeValidationHandler.java

+ */
+public class RoleBasedScopeValidationHandler implements ScopeValidationHandler {
+
+    private static final Log LOG = LogFactory.getLog(DefaultOAuth2ScopeValidator.class);


private static final Log LOG = LogFactory.getLog(RoleBasedScopeValidationHandler.class);

shashimalcse and others added 12 commits October 10, 2023 21:48

add policy handlers

0006d2a

add new scope validtaor

46756df

add system scope handling

fa30e13

filter role by apps

34473ae

add user role resolving

e04fcde

implement rbac

0441a47

fix get user group and role ids list

5832574

fix getuser group

a7aac52

fix null exception

91e08be

introduce islegacyauthzruntime

ef401fe

fix legacy app validator skip return

01b9aa9

Merge branch 'master' into shashimalcse-patch-100

e1e097d

shashimalcse marked this pull request as ready for review October 21, 2023 10:39

shashimalcse added 3 commits October 22, 2023 00:24

fix formatting

61125a7

fix xacml engagement

392112b

Merge branch 'shashimalcse-patch-100' of https://github.com/shashimal…

a0a1e66

…cse/identity-inbound-auth-oauth into shashimalcse-patch-100

shashimalcse mentioned this pull request Oct 24, 2023

[Feature] Support application roles for Identity Server and support RBAC for apps wso2/product-is#16363

Closed

shashimalcse added 4 commits October 24, 2023 13:01

fix user role resolver

c68a58d

remove registered scopes

7d590e9

add authzutil class

e60d410

move legacy check to authzutil

1df3552

shashimalcse commented Oct 24, 2023

View reviewed changes

...ity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponent.java Show resolved Hide resolved

shashimalcse commented Oct 24, 2023

View reviewed changes

...uth/src/main/java/org/wso2/carbon/identity/oauth2/internal/OAuth2ServiceComponentHolder.java Outdated Show resolved Hide resolved

shashimalcse commented Oct 24, 2023

View reviewed changes

...ava/org/wso2/carbon/identity/oauth2/validators/validationhandler/ScopeValidationContext.java Show resolved Hide resolved

shashimalcse and others added 5 commits October 24, 2023 20:23

add licence headers

3c1b5de

Merge branch 'master' into shashimalcse-patch-100

c697609

fix for asub org user

e9d52c8

fix conflict

22e54eb

fix kernel version

213219c

sadilchamishka previously approved these changes Oct 25, 2023

View reviewed changes

fix compile issue wth fasterxml

2f94647

shashimalcse dismissed sadilchamishka’s stale review via 2f94647 October 25, 2023 04:16

fix m2m can handle

02b537c

ThaminduR mentioned this pull request Oct 25, 2023

Introduce Resource Access Control V2 wso2-extensions/identity-carbon-auth-rest#245

Merged

shashimalcse added 4 commits October 25, 2023 13:55

handle switch grant

24717fc

fix xacml validator enagage

d510014

fix method name

8c74de8

fix test failing

ca66713

shashimalcse and others added 2 commits October 25, 2023 17:44

remove SYSTEM scope from allowed scopes

2e4ee32

Merge branch 'master' into shashimalcse-patch-100

b0c409a

fix console scopes issue

b4e8417

fix internal login scopes issue in client credentials

5f61cde

AnuradhaSK approved these changes Oct 26, 2023

View reviewed changes

shashimalcse merged commit 57a31ad into wso2-extensions:master Oct 26, 2023

AnuradhaSK reviewed Oct 26, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Default OAuth2 Scope Validator implementation #2206

Default OAuth2 Scope Validator implementation #2206

shashimalcse commented Oct 19, 2023 •

edited

Loading

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 26, 2023

jenkins-is-staging commented Oct 26, 2023

shashimalcse commented Oct 26, 2023

AnuradhaSK Oct 26, 2023

AnuradhaSK Oct 26, 2023

AnuradhaSK Oct 26, 2023

Default OAuth2 Scope Validator implementation #2206

Default OAuth2 Scope Validator implementation #2206

Conversation

shashimalcse commented Oct 19, 2023 • edited Loading

Proposed changes in this pull request

Related Issues :

When should this PR be merged

Follow up actions

Checklist (for reviewing)

General

Functionality

Code

Tests

Security

Documentation

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 25, 2023

jenkins-is-staging commented Oct 26, 2023

jenkins-is-staging commented Oct 26, 2023

shashimalcse commented Oct 26, 2023

AnuradhaSK Oct 26, 2023

Choose a reason for hiding this comment

AnuradhaSK Oct 26, 2023

Choose a reason for hiding this comment

AnuradhaSK Oct 26, 2023

Choose a reason for hiding this comment

shashimalcse commented Oct 19, 2023 •

edited

Loading