Add support for rich authorization requests #2511

VimukthiRajapaksha · 2024-07-02T10:57:49Z

$Subject

Proposed changes in this pull request

[List all changes you want to add here. If you fixed an issue, please
add a reference to that issue as well.]

When should this PR be merged

[Please describe any preconditions that need to be addressed before we
can merge this pull request.]

Follow up actions

[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]

Checklist (for reviewing)

General

Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
Is the PR labeled correctly?

Functionality

Are all requirements met? Compare implemented functionality with the requirements specification.
Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
Are all UI and API inputs run through forms or serializers?
Are all external inputs validated and sanitized appropriately?
Does all branching logic have a default case?
Does this solution handle outliers and edge cases gracefully?
Are all external communications secured and restricted to SSL?

Documentation

Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

CLAassistant · 2024-07-02T10:57:54Z

All committers have signed the CLA.

- Accept 'authorization_details' field in the authorization request. - Persist code and consent authorization details in the database. - Add support for oauth.rar and oauth.rar.common modules. - Read custom implementations of AuthorizationDetailsProvider from SPI. - Display rich authorization details in the consent UI.

shashimalcse · 2024-07-11T02:07:01Z

...ndpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/authz/OAuth2AuthzEndpoint.java

@@ -2980,6 +3014,22 @@ private String doUserAuthorization(OAuthMessage oAuthMessage, String sessionData
            return handleAuthorizationFailureBeforeConsent(oAuthMessage, oauth2Params, authorizeRespDTO);
        }

+        try {
+            validateAuthorizationDetailsBeforeConsent(oAuthMessage, oauth2Params, authzReqDTO);


make sure to add diagnostic logs

shashimalcse · 2024-07-11T02:08:47Z

...ndpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/authz/OAuth2AuthzEndpoint.java

+            OAuthAuthzReqMessageContext oAuthAuthzReqMessageContext =
+                    oAuthMessage.getSessionDataCacheEntry().getAuthzReqMsgCtx();
+            oAuthAuthzReqMessageContext.setAuthorizationDetails(validatedAuthorizationDetails);
+        } catch (IdentityOAuth2Exception | InvalidOAuthClientException e) {


why we catch client exception and throw system exception here?

shashimalcse · 2024-07-11T02:15:38Z

....oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/EndpointUtil.java

+                // Append authorization details to consent page url
+                if (AuthorizationDetailsUtils.isRichAuthorizationRequest(params)) {
+                    consentPageUrl = consentPageUrl + "&" + AuthorizationDetailsConstants.AUTHORIZATION_DETAILS + "="
+                            + URLEncoder.encode(params.getAuthorizationDetails().toJsonString(), UTF_8);


Is it good to encode an entire JSON string and send it as a parameter? This can cause several issues

shashimalcse · 2024-07-11T02:21:07Z

...rc/main/java/org/wso2/carbon/identity/oauth2/rar/common/dao/AuthorizationDetailsDAOImpl.java

+    public int[] addUserConsentedAuthorizationDetails(
+            final List<AuthorizationDetailsConsentDTO> authorizationDetailsConsentDTOs) throws SQLException {
+
+        try (final Connection connection = IdentityDatabaseUtil.getDBConnection(false);


Why not apply a transaction here?

please check the other places

shashimalcse · 2024-07-11T02:23:40Z

...auth.rar.common/src/main/java/org/wso2/carbon/identity/oauth2/rar/common/dao/SQLQueries.java

+        // Private constructor to prevent instantiation
+    }
+
+    public static final String ADD_OAUTH2_CODE_AUTHORIZATION_DETAILS =


please make sure to check json persist with all db types

shashimalcse · 2024-07-11T04:40:46Z

...ndpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/authz/OAuth2AuthzEndpoint.java

+     * @throws OAuthSystemException                    If there is an error during the validation process.
+     * @throws AuthorizationDetailsProcessingException If there is an error processing the authorization details.
+     */
+    private void validateAuthorizationDetailsBeforeConsent(final OAuthMessage oAuthMessage,


can we move this validation logic to service layer where we validate scopes?

shashimalcse · 2024-07-11T05:09:17Z

Please clearly specify the following:

What types of validations are performed (e.g., tenant-level, app-level, policy)?
Where are these validations applied (e.g., during grant types, code flow, token flow)?
What types of decisions are made based on these validations (e.g., coarse-grained, fine-grained)?

- Accept 'authorization_details' field in the token request - Persist access token authorization details in the database - Moving common logic from oauth.rar.common module to a new rar package within oauth module - Adds RAR support for hybrid authorization flows

VimukthiRajapaksha force-pushed the master_rar branch from 75f66df to f9d06d5 Compare July 2, 2024 11:02

VimukthiRajapaksha force-pushed the master_rar branch from f9d06d5 to c8d568e Compare July 2, 2024 11:04

shashimalcse reviewed Jul 11, 2024

View reviewed changes

VimukthiRajapaksha force-pushed the master_rar branch 2 times, most recently from 47c6ba1 to 87e7c19 Compare July 31, 2024 12:01

resolve merge conflicts

dd8f27f

VimukthiRajapaksha force-pushed the master_rar branch from 87e7c19 to dd8f27f Compare July 31, 2024 12:26

VimukthiRajapaksha requested a review from shashimalcse August 5, 2024 04:11

VimukthiRajapaksha added 4 commits August 7, 2024 15:43

Add unit tests for the rar module

824163c

Merge remote-tracking branch 'origin/master' into master_rar

3360d4e

Add unit tests

3031c32

Fix merge conflicts

376e5cc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for rich authorization requests #2511

Add support for rich authorization requests #2511

VimukthiRajapaksha commented Jul 2, 2024

CLAassistant commented Jul 2, 2024 •

edited

Loading

shashimalcse Jul 11, 2024

shashimalcse Jul 11, 2024

shashimalcse Jul 11, 2024

shashimalcse Jul 11, 2024

shashimalcse Jul 11, 2024

shashimalcse Jul 11, 2024

shashimalcse Jul 11, 2024

shashimalcse commented Jul 11, 2024

Add support for rich authorization requests #2511

Are you sure you want to change the base?

Add support for rich authorization requests #2511

Conversation

VimukthiRajapaksha commented Jul 2, 2024

Proposed changes in this pull request

When should this PR be merged

Follow up actions

Checklist (for reviewing)

General

Functionality

Code

Tests

Security

Documentation

CLAassistant commented Jul 2, 2024 • edited Loading

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse Jul 11, 2024

Choose a reason for hiding this comment

shashimalcse commented Jul 11, 2024

CLAassistant commented Jul 2, 2024 •

edited

Loading