From 7d1168135c75c31781cd13da66993b77f9c4801c Mon Sep 17 00:00:00 2001 From: Thamindu Aluthwala Date: Sun, 25 Jun 2023 23:37:13 +0530 Subject: [PATCH] Fix scopes being added through user claims --- .../identity/oauth2/token/JWTTokenIssuer.java | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java b/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java index 3ff05bc537..9125e83999 100644 --- a/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java +++ b/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java @@ -483,11 +483,6 @@ protected JWTClaimsSet createJWTClaimSet(OAuthAuthzReqMessageContext authAuthzRe jwtClaimsSetBuilder.notBeforeTime(new Date(curTimeInMillis)); jwtClaimsSetBuilder.claim(CLIENT_ID, consumerKey); - String scope = getScope(authAuthzReqMessageContext, tokenReqMessageContext); - if (StringUtils.isNotEmpty(scope)) { - jwtClaimsSetBuilder.claim(SCOPE, scope); - } - jwtClaimsSetBuilder.claim(OAuthConstants.AUTHORIZED_USER_TYPE, getAuthorizedUserType(authAuthzReqMessageContext, tokenReqMessageContext)); @@ -518,6 +513,15 @@ protected JWTClaimsSet createJWTClaimSet(OAuthAuthzReqMessageContext authAuthzRe } } } + + String scope = getScope(authAuthzReqMessageContext, tokenReqMessageContext); + if (StringUtils.isNotEmpty(scope)) { + jwtClaimsSetBuilder.claim(SCOPE, scope); + } else { + // To prevent scope claim being added through user attributes. + jwtClaimsSetBuilder.claim(SCOPE, null); + } + // Include token binding. jwtClaimsSet = handleTokenBinding(jwtClaimsSetBuilder, tokenReqMessageContext);