Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve organization sso check #2360

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Improve organization sso check #2360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions ....identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/dao/AccessTokenDAOImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3114,12 +3114,11 @@ public Set<AccessTokenDO> getAccessTokensByBindingRef(String bindingRef) throws
if (!OAuthConstants.AuthorizedOrganization.NONE.equals(authorizedOrganization)) {
user.setAccessingOrganization(authorizedOrganization);
user.setUserResidentOrganization(resolveOrganizationId(user.getTenantDomain()));
/* Tenant domain of the application is set as the authenticated user tenant domain
for the organization SSO login users. */
if (user.isFederatedUser()) {
user.setTenantDomain(
OAuth2Util.getTenantDomain(IdentityTenantUtil.getLoginTenantId()));
}
}
/* Tenant domain of the application is set as the authenticated user tenant domain for the
users whose identity is managed by an organization. */
if (user.isOrganizationUser()) {
user.setTenantDomain(OAuth2Util.getTenantDomain(IdentityTenantUtil.getLoginTenantId()));
}
Timestamp issuedTime = resultSet
.getTimestamp("TIME_CREATED", Calendar.getInstance(TimeZone.getTimeZone(UTC)));
Expand Down
18 changes: 5 additions & 13 deletions ...ntity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/dao/TokenManagementDAOImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@

import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
Expand Down Expand Up @@ -210,16 +209,14 @@ public RefreshTokenValidationDataDO validateRefreshToken(String consumerKey, Str
resultSet.getString(18) != null) {
extendedParams.put(resultSet.getString(17), resultSet.getString(18));
}
// For B2B users, the users tenant domain and user resident organization should be properly set.
if (!OAuthConstants.AuthorizedOrganization.NONE.equals(authorizedOrganization)) {
user.setAccessingOrganization(authorizedOrganization);
user.setUserResidentOrganization(resolveOrganizationId(user.getTenantDomain()));
/* Setting user's tenant domain as app residing tenant domain is not required once console is
registered in each tenant. */
String appResideOrg = getAppTenantDomain();
if (StringUtils.isNotEmpty(appResideOrg) && user.isFederatedUser()) {
user.setTenantDomain(appResideOrg);
}
}
/* Tenant domain of the application is set as the authenticated user tenant domain for the
users whose identity is managed by an organization. */
if (user.isOrganizationUser()) {
user.setTenantDomain(IdentityTenantUtil.getTenantDomainFromContext());
}
validationDataDO.setAuthorizedUser(user);

Expand Down Expand Up @@ -821,11 +818,6 @@ public Set<String> getAllTimeAuthorizedClientIds(AuthenticatedUser authzUser) th
return distinctConsumerKeys;
}

private String getAppTenantDomain() {

return IdentityTenantUtil.getTenantDomainFromContext();
}

private String resolveOrganizationId(String tenantDomain) throws IdentityOAuth2Exception {

try {
Expand Down
21 changes: 9 additions & 12 deletions ...rc/main/java/org/wso2/carbon/identity/openidconnect/DefaultOIDCClaimsCallbackHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ private Map<String, Object> getUserClaimsInOIDCDialect(OAuthTokenReqMessageConte
// Map<(http://wso2.org/claims/email, email), "[email protected]">
Map<ClaimMapping, String> userAttributes = getCachedUserAttributes(requestMsgCtx);
if (userAttributes.isEmpty() && (isLocalUser(requestMsgCtx.getAuthorizedUser())
|| isOrganizationSsoUserSwitchingOrganization(requestMsgCtx.getAuthorizedUser()))) {
|| isOrganizationUserSwitchingOrganization(requestMsgCtx.getAuthorizedUser()))) {
if (log.isDebugEnabled()) {
log.debug("User attributes not found in cache against the access token or authorization code. " +
"Retrieving claims for local user: " + requestMsgCtx.getAuthorizedUser() + " from userstore.");
Expand Down Expand Up @@ -657,20 +657,17 @@ private Map<String, String> getUserClaimsInLocalDialect(String username,
}

/**
* Check whether an organization SSO user is trying to switch the organization.
* Check whether a user managed by an organization is trying to switch to another organization.
*
* @param authorizedUser authorized user from the token request.
* @return true if an organization SSO user is trying to switch the organization.
* @return true if an organization user is trying to switch to another organization.
*/
private boolean isOrganizationSsoUserSwitchingOrganization(AuthenticatedUser authorizedUser) {

String accessingOrganization = authorizedUser.getAccessingOrganization();
String userResidentOrganization = authorizedUser.getUserResidentOrganization();
/* A federated user with resident organization is considered as an organization SSO user. When the accessing
organization is different to the resident organization, it means the user is trying to switch the
organization. */
return authorizedUser.isFederatedUser() && userResidentOrganization != null && !userResidentOrganization.equals
(accessingOrganization);
private boolean isOrganizationUserSwitchingOrganization(AuthenticatedUser authorizedUser) {

/* For an organization user, when accessing organization is different to the resident organization,
it means the user is trying to switch to different organization. */
return authorizedUser.isOrganizationUser() &&
!authorizedUser.getUserResidentOrganization().equals(authorizedUser.getAccessingOrganization());
}

/**
Expand Down
Loading