OIDC scopes are in the response when requesting access token with client credentials #2033
Conversation
…ess token with client credential
|
|
…ting access token with client credential
| String[] scopes = (String[]) ArrayUtils.removeElement(tokReqMsgCtx.getScope(), OAuthConstants.Scope.OPENID); | ||
|
|
||
| //Get all the registered oidc scopes of a tenant | ||
| List<String> oidcScopes = OAuth2Util.getOIDCScopes(tokReqMsgCtx.getOauth2AccessTokenReqDTO() | ||
| .getTenantDomain()); | ||
|
|
||
| //Check whether the is there any oidc scope in the request | ||
| for (String scope : scopes) { | ||
| if (oidcScopes.contains(scope)) { | ||
| scopes = (String[]) ArrayUtils.removeElement(scopes, scope); | ||
| } | ||
| } |
There was a problem hiding this comment.
Can we improve this logic to filter the OIDC scopes at once without repeatedly removing the oidc scopes one by one?
mefarazath
changed the title
| // Remove openid scope from the token message context. | ||
| String[] scopes = (String[]) ArrayUtils.removeElement(tokReqMsgCtx.getScope(), OAuthConstants.Scope.OPENID); | ||
|
|
||
| //Get all the registered oidc scopes of a tenant |
There was a problem hiding this comment.
| //Get all the registered oidc scopes of a tenant | |
| // Get all the registered OIDC scopes of a tenant. |
Follow the correct formatting for comments
| .collect(Collectors.toList()); | ||
|
|
||
| tokReqMsgCtx.setScope(filteredScopes.toArray(new String[0])); | ||
|
|
||
| if (log.isDebugEnabled()) { | ||
| log.debug("id_token is not allowed for requested grant type: " + grantType + ". Removing 'openid' " + |
There was a problem hiding this comment.
shall we modify this debug log
|
PR builder started |
| String[] scopes = (String[]) ArrayUtils.removeElement(tokReqMsgCtx.getScope(), OAuthConstants.Scope.OPENID); | ||
| tokReqMsgCtx.setScope(scopes); | ||
| //Remove OIDC scopes from the token message context | ||
|
|
|
PR builder completed |
...dentity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/validators/OIDCScopeHandler.java
Outdated
Show resolved
Hide resolved
|
PR builder started |
|
PR builder completed |
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/5419309519
…o2/carbon/identity/oauth2/validators/OIDCScopeHandler.java
Improve the debug log
Issue
OIDC scopes are in the response when requesting access token with client credentials #15486( Fixes wso2/product-is#15486) - When requesting access token request with client credentials grant type including OIDC scopes, there are OIDC scopes in the response such as "email", "profile", "phone". These scopes shouldn't be there in the response.
Approach
The logic for this part is in the "validateScope" method at the "OIDCScopeHandler.java" class
Goal
OIDC scopes should not be in the response.