Skip to content

Commit bbe56e4

Browse files
ppiernikppiernik
committed
UY-1510 QA fixes, add debug log, consent screen shows unfiltered
attributes
1 parent 7bc7209 commit bbe56e4

File tree

6 files changed

+43
-18
lines changed

6 files changed

+43
-18
lines changed

‎oauth/src/main/java/pl/edu/icm/unity/oauth/as/AttributeFilteringSpec.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,13 @@
77

88
import java.util.Set;
99

10+
1011
public record AttributeFilteringSpec(
1112
String attributeName,
1213
Set<String> values)
1314
{
15+
public String toString()
16+
{
17+
return attributeName + "=" + values.toString();
18+
}
1419
}

‎oauth/src/main/java/pl/edu/icm/unity/oauth/as/AttributeValueFilter.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,17 @@
1212
import java.util.Set;
1313
import java.util.stream.Collectors;
1414

15+
import org.apache.logging.log4j.Logger;
16+
1517
import pl.edu.icm.unity.base.attribute.Attribute;
18+
import pl.edu.icm.unity.base.utils.Log;
1619
import pl.edu.icm.unity.engine.api.attributes.DynamicAttribute;
1720

18-
class AttributeValueFilter
21+
public class AttributeValueFilter
1922
{
20-
static Set<DynamicAttribute> filterAttributes(List<AttributeFilteringSpec> filter,
23+
private static final Logger log = Log.getLogger(Log.U_SERVER_OAUTH, AttributeValueFilter.class);
24+
25+
public static Set<DynamicAttribute> filterAttributes(List<AttributeFilteringSpec> filter,
2126
Collection<DynamicAttribute> attributes)
2227
{
2328
if(filter == null)
@@ -41,6 +46,8 @@ static Set<DynamicAttribute> filterAttributes(List<AttributeFilteringSpec> filte
4146
.values()
4247
.contains(v))
4348
.toList();
49+
log.debug("Filtered by claim filter attributes values for attribute {}: {}", attribute.getAttribute().getName(), filteredValues);
50+
4451
if (filteredValues.isEmpty())
4552
{
4653
continue;

‎oauth/src/main/java/pl/edu/icm/unity/oauth/as/AttributeValueFilterUtils.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,10 +70,18 @@ public static List<AttributeFilteringSpec> getFiltersFromScopes(Scope scopes)
7070
}
7171
}
7272

73-
return filterByAttrName.entrySet()
73+
List<AttributeFilteringSpec> mappedFilters = filterByAttrName.entrySet()
7474
.stream()
7575
.map(e -> new AttributeFilteringSpec(e.getKey(), e.getValue()))
7676
.toList();
77+
78+
if (!mappedFilters.isEmpty())
79+
{
80+
log.debug("Requested claim value filters: {}", mappedFilters);
81+
}
82+
83+
return mappedFilters;
84+
7785
}
7886

7987
public static List<AttributeFilteringSpec> mergeFiltersWithPreservingLast(List<AttributeFilteringSpec> firstStageFilters,

‎oauth/src/main/java/pl/edu/icm/unity/oauth/as/token/ClientCredentialsProcessor.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ public OAuthToken processClientFlowRequest(String scope) throws OAuthValidationE
111111
throw new OAuthValidationException("Internal error");
112112
}
113113
Set<DynamicAttribute> filteredAttributes = OAuthProcessor.filterAttributes(
114-
translationResult, requestedAttributes, AttributeValueFilterUtils.getFiltersFromScopes(parsedScope));
114+
translationResult, requestedAttributes);
115115
UserInfo userInfo = OAuthProcessor.prepareUserInfoClaimSet(client, filteredAttributes);
116116
internalToken.setUserInfo(userInfo.toJSONObject().toJSONString());
117117
return internalToken;

‎oauth/src/main/java/pl/edu/icm/unity/oauth/as/webauthz/ASConsentDeciderServlet.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import java.util.List;
1313
import java.util.Map;
1414
import java.util.Optional;
15+
import java.util.Set;
1516
import java.util.stream.Collectors;
1617

1718
import org.apache.logging.log4j.Logger;
@@ -44,6 +45,7 @@
4445
import pl.edu.icm.unity.engine.api.idp.IdPEngine;
4546
import pl.edu.icm.unity.engine.api.policyAgreement.PolicyAgreementManagement;
4647
import pl.edu.icm.unity.engine.api.translation.out.TranslationResult;
48+
import pl.edu.icm.unity.oauth.as.AttributeValueFilter;
4749
import pl.edu.icm.unity.oauth.as.OAuthAuthzContext;
4850
import pl.edu.icm.unity.oauth.as.OAuthErrorResponseException;
4951
import pl.edu.icm.unity.oauth.as.OAuthIdpStatisticReporter;
@@ -209,9 +211,10 @@ protected void autoReplay(OAuthClientSettings clientPreferences, OAuthAuthzConte
209211
oauthCtx.getConfig().getSubjectIdentityType());
210212
log.info("Authentication of " + selectedIdentity);
211213
Collection<DynamicAttribute> attributes = OAuthProcessor.filterAttributes(userInfo,
212-
oauthCtx.getEffectiveRequestedAttrs(), oauthCtx.getClaimValueFilters());
213-
ACRConsistencyValidator.verifyACRAttribute(oauthCtx, attributes);
214-
respDoc = oauthProcessor.prepareAuthzResponseAndRecordInternalState(attributes, selectedIdentity, oauthCtx,
214+
oauthCtx.getEffectiveRequestedAttrs());
215+
Set<DynamicAttribute> filteredAttributes = AttributeValueFilter.filterAttributes(oauthCtx.getClaimValueFilters(), attributes);
216+
ACRConsistencyValidator.verifyACRAttribute(oauthCtx, filteredAttributes);
217+
respDoc = oauthProcessor.prepareAuthzResponseAndRecordInternalState(filteredAttributes, selectedIdentity, oauthCtx,
215218
statReporter, InvocationContext.getCurrent().getLoginSession().getAuthenticationTime(), oauthCtx.getClaimValueFilters());
216219
} catch (OAuthErrorResponseException e)
217220
{

‎oauth/src/main/java/pl/edu/icm/unity/oauth/as/webauthz/OAuthAuthzView.java‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
import pl.edu.icm.unity.engine.api.translation.out.TranslationResult;
6262
import pl.edu.icm.unity.engine.api.utils.FreemarkerAppHandler;
6363
import pl.edu.icm.unity.oauth.as.AttributeFilteringSpec;
64+
import pl.edu.icm.unity.oauth.as.AttributeValueFilter;
6465
import pl.edu.icm.unity.oauth.as.AttributeValueFilterUtils;
6566
import pl.edu.icm.unity.oauth.as.OAuthASProperties;
6667
import pl.edu.icm.unity.oauth.as.OAuthAuthzContext;
@@ -198,14 +199,16 @@ private void activeValueSelectionAndConsentStage(OAuthAuthzContext ctx, OAuthASP
198199
identity = idpEngine.getIdentity(translationResult, ctx.getConfig().getSubjectIdentityType());
199200

200201
Set<DynamicAttribute> allAttributes = OAuthProcessor.filterAttributes(translationResult,
201-
ctx.getEffectiveRequestedAttrs(), ctx.getClaimValueFilters());
202+
ctx.getEffectiveRequestedAttrs());
203+
204+
Set<DynamicAttribute> filteredByClaimAttributes = AttributeValueFilter.filterAttributes(ctx.getClaimValueFilters(), allAttributes);
202205

203206
Optional<ActiveValueSelectionConfig> activeValueSelectionConfig = ActiveValueClientHelper
204-
.getActiveValueSelectionConfig(config.getActiveValueClients(), ctx.getClientUsername(), allAttributes);
207+
.getActiveValueSelectionConfig(config.getActiveValueClients(), ctx.getClientUsername(), filteredByClaimAttributes);
205208

206209
try
207210
{
208-
ACRConsistencyValidator.verifyACRAttribute(ctx, allAttributes);
211+
ACRConsistencyValidator.verifyACRAttribute(ctx, filteredByClaimAttributes);
209212
} catch (OAuthErrorResponseException e)
210213
{
211214
oauthResponseHandler.returnOauthResponseNotThrowingAndReportStatistic(e.getOauthResponse(), false, ctx,
@@ -214,19 +217,18 @@ private void activeValueSelectionAndConsentStage(OAuthAuthzContext ctx, OAuthASP
214217
}
215218

216219
if (activeValueSelectionConfig.isPresent())
217-
showActiveValueSelectionScreen(activeValueSelectionConfig.get());
220+
showActiveValueSelectionScreen(activeValueSelectionConfig.get(), ctx);
218221
else
219-
gotoConsentStage(allAttributes, null);
222+
gotoConsentStage(allAttributes, null, ctx);
220223
}
221224

222-
private void gotoConsentStage(Collection<DynamicAttribute> attributes, Collection<DynamicAttribute> filteredAttributes)
225+
private void gotoConsentStage(Collection<DynamicAttribute> attributes, Collection<DynamicAttribute> filteredAttributes, OAuthAuthzContext context)
223226
{
224-
OAuthAuthzContext context = OAuthSessionService.getVaadinContext();
225227
if (!forceConsentIfConsentPrompt(context))
226228
{
227229
if (context.getConfig().isSkipConsent())
228230
{
229-
onFinalConfirm(identity, attributes, filteredAttributes);
231+
onFinalConfirm(identity, AttributeValueFilter.filterAttributes(context.getClaimValueFilters(), attributes), filteredAttributes);
230232
return;
231233
} else if (isNonePrompt(context))
232234
{
@@ -236,7 +238,7 @@ private void gotoConsentStage(Collection<DynamicAttribute> attributes, Collectio
236238
}
237239
OAuthConsentScreen consentScreen = new OAuthConsentScreen(msg, handlersRegistry, preferencesMan,
238240
authnProcessor, idTypeSupport, aTypeSupport, identity, attributes,
239-
this::onDecline, (i,a) -> onFinalConfirm(i, a, filteredAttributes), oauthResponseHandler);
241+
this::onDecline, (i,a) -> onFinalConfirm(i, AttributeValueFilter.filterAttributes(context.getClaimValueFilters(), a) , filteredAttributes), oauthResponseHandler);
240242
getContent().removeAll();
241243
getContent().add(consentScreen);
242244
}
@@ -260,11 +262,11 @@ private boolean forceConsentIfConsentPrompt(OAuthAuthzContext oauthCtx)
260262
return oauthCtx.getPrompts().contains(Prompt.CONSENT);
261263
}
262264

263-
private void showActiveValueSelectionScreen(ActiveValueSelectionConfig config)
265+
private void showActiveValueSelectionScreen(ActiveValueSelectionConfig config, OAuthAuthzContext ctx)
264266
{
265267
ActiveValueSelectionScreen valueSelectionScreen = new ActiveValueSelectionScreen(msg, handlersRegistry,
266268
authnProcessor, config.singleSelectableAttributes, config.multiSelectableAttributes,
267-
config.remainingAttributes, OAUTH_CONSENT_DECIDER_SERVLET_PATH, this::onDecline, (selectionResult) -> gotoConsentStage(selectionResult.allAttributes(), selectionResult.filteredAttributes()));
269+
config.remainingAttributes, OAUTH_CONSENT_DECIDER_SERVLET_PATH, this::onDecline, (selectionResult) -> gotoConsentStage(selectionResult.allAttributes(), selectionResult.filteredAttributes(), ctx));
268270
getContent().removeAll();
269271
getContent().add(valueSelectionScreen);
270272
}

0 commit comments

Comments
 (0)