Skip to content

Commit 2ca7d40

Browse files
NithinKurubaNithinKuruba
authored
fix: request ppid only for otp idp (#451)
1 parent 9087ec0 commit 2ca7d40

File tree

3 files changed

+65
-64
lines changed

3 files changed

+65
-64
lines changed

‎docker/keycloak/extensions-26/services/src/main/java/com/github/bcgov/keycloak/protocol/oidc/mappers/PPIDMapper.java‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -79,21 +79,21 @@ protected void setClaim(IDToken token,
7979
String tokenClaim = mappingModel.getConfig().get(CLAIM_NAME);
8080
try {
8181
String idp = userSession.getNotes().get("identity_provider");
82-
83-
ProtocolMapperModel pzMapper = clientSessionCtx.getClientSession().getClient()
84-
.getProtocolMapperByName(OIDCLoginProtocol.LOGIN_PROTOCOL, PRIVACY_ZONE_MAPPER);
85-
86-
if (pzMapper != null) {
87-
String ppid = PPID.getPpid(applicationProperties.getIssuer(idp), userSession.getUser().getEmail(),
88-
pzMapper.getConfig().get(CLAIM_VALUE));
89-
90-
if (!StringUtil.isNullOrEmpty(ppid)) {
91-
Map<String, Object> otherClaims = token.getOtherClaims();
92-
otherClaims.put(tokenClaim, ppid);
93-
}
94-
} else
95-
logger.errorf("Could not find %s mapper", PRIVACY_ZONE_MAPPER);
96-
82+
if (idp.equalsIgnoreCase("otp")) {
83+
ProtocolMapperModel pzMapper = clientSessionCtx.getClientSession().getClient()
84+
.getProtocolMapperByName(OIDCLoginProtocol.LOGIN_PROTOCOL, PRIVACY_ZONE_MAPPER);
85+
86+
if (pzMapper != null) {
87+
String ppid = PPID.getPpid(applicationProperties.getIssuer(idp), userSession.getUser().getEmail(),
88+
pzMapper.getConfig().get(CLAIM_VALUE));
89+
90+
if (!StringUtil.isNullOrEmpty(ppid)) {
91+
Map<String, Object> otherClaims = token.getOtherClaims();
92+
otherClaims.put(tokenClaim, ppid);
93+
}
94+
} else
95+
logger.errorf("Could not find %s mapper", PRIVACY_ZONE_MAPPER);
96+
}
9797
} catch (Exception e) {
9898
logger.errorf("Failed to add claim %s to the token", tokenClaim);
9999
}

‎docker/keycloak/extensions-26/services/src/main/java/com/github/bcgov/keycloak/protocol/saml/mappers/PPIDAttributeMapper.java‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -77,21 +77,22 @@ public void transformAttributeStatement(AttributeStatementType attributeStatemen
7777
String ppidKey = mappingModel.getConfig().get(ATTRIBUTE_NAME);
7878
try {
7979
String idp = userSession.getNotes().get("identity_provider");
80-
81-
ProtocolMapperModel pzMapper = clientSession.getClient()
82-
.getProtocolMapperByName(SamlProtocol.LOGIN_PROTOCOL, PRIVACY_ZONE_MAPPER);
83-
if (pzMapper != null) {
84-
String ppid = PPID.getPpid(applicationProperties.getIssuer(idp), userSession.getUser().getEmail(),
85-
pzMapper.getConfig().get(ATTRIBUTE_VALUE));
86-
if (!StringUtil.isNullOrEmpty(ppid)) {
87-
AttributeType attribute = new AttributeType(ppidKey.trim());
88-
attribute.setNameFormat(JBossSAMLURIConstants.ATTRIBUTE_FORMAT_BASIC.get());
89-
attribute.addAttributeValue(ppid);
90-
attributeStatement.addAttribute(new AttributeStatementType.ASTChoiceType(attribute));
91-
}
92-
} else
93-
logger.errorf("Could not find %s mapper", PRIVACY_ZONE_MAPPER);
94-
80+
if (idp.equalsIgnoreCase("otp")) {
81+
ProtocolMapperModel pzMapper = clientSession.getClient()
82+
.getProtocolMapperByName(SamlProtocol.LOGIN_PROTOCOL, PRIVACY_ZONE_MAPPER);
83+
if (pzMapper != null) {
84+
String ppid = PPID.getPpid(applicationProperties.getIssuer(idp), userSession.getUser().getEmail(),
85+
pzMapper.getConfig().get(ATTRIBUTE_VALUE));
86+
if (!StringUtil.isNullOrEmpty(ppid)) {
87+
AttributeType attribute = new AttributeType(ppidKey.trim());
88+
attribute.setNameFormat(JBossSAMLURIConstants.ATTRIBUTE_FORMAT_BASIC.get());
89+
attribute.addAttributeValue(ppid);
90+
attributeStatement.addAttribute(new AttributeStatementType.ASTChoiceType(attribute));
91+
}
92+
} else
93+
logger.errorf("Could not find %s mapper", PRIVACY_ZONE_MAPPER);
94+
}
95+
// remove privacy zone attribute
9596
List<ASTChoiceType> attributes = attributeStatement.getAttributes();
9697
for (int i = attributes.size(); i-- > 0;) {
9798
AttributeStatementType.ASTChoiceType attribute = attributes.get(i);

‎docker/keycloak/extensions-26/services/src/main/java/com/github/bcgov/keycloak/protocol/saml/mappers/PPIDAttributeMapperNameId.java‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -57,44 +57,43 @@ public class PPIDAttributeMapperNameId extends AbstractSAMLProtocolMapper
5757
public ResponseType transformLoginResponse(ResponseType response,
5858
ProtocolMapperModel mappingModel, KeycloakSession session,
5959
UserSessionModel userSession, ClientSessionContext clientSessionCtx) {
60-
61-
String nameIdFormat = mappingModel.getConfig().get(NAMEID_FORMAT);
62-
6360
String idp = userSession.getNotes().get("identity_provider");
61+
if (idp.equalsIgnoreCase("otp")) {
62+
String nameIdFormat = mappingModel.getConfig().get(NAMEID_FORMAT);
63+
ProtocolMapperModel pzMapper = clientSessionCtx.getClientSession().getClient()
64+
.getProtocolMapperByName(SamlProtocol.LOGIN_PROTOCOL, PRIVACY_ZONE_MAPPER);
65+
if (pzMapper != null) {
66+
String ppid = PPID.getPpid(applicationProperties.getIssuer(idp), userSession.getUser().getEmail(),
67+
pzMapper.getConfig().get(PZ_ATTRIBUTE_VALUE));
68+
69+
if (!StringUtil.isNullOrEmpty(ppid)) {
70+
if (StringUtil.isNullOrEmpty(nameIdFormat)) {
71+
nameIdFormat = JBossSAMLURIConstants.NAMEID_FORMAT_PERSISTENT.get();
72+
}
6473

65-
ProtocolMapperModel pzMapper = clientSessionCtx.getClientSession().getClient()
66-
.getProtocolMapperByName(SamlProtocol.LOGIN_PROTOCOL, PRIVACY_ZONE_MAPPER);
67-
if (pzMapper != null) {
68-
String ppid = PPID.getPpid(applicationProperties.getIssuer(idp), userSession.getUser().getEmail(),
69-
pzMapper.getConfig().get(PZ_ATTRIBUTE_VALUE));
70-
71-
if (!StringUtil.isNullOrEmpty(ppid)) {
72-
if (StringUtil.isNullOrEmpty(nameIdFormat)) {
73-
nameIdFormat = JBossSAMLURIConstants.NAMEID_FORMAT_PERSISTENT.get();
74-
}
75-
76-
NameIDType nameID = new NameIDType();
77-
nameID.setFormat(URI.create(nameIdFormat));
78-
nameID.setValue(ppid);
79-
80-
SubjectType subject = new SubjectType();
81-
SubjectType.STSubType subType = new SubjectType.STSubType();
82-
subType.addBaseID(nameID);
83-
subject.setSubType(subType);
84-
85-
// Set NameID in the SAML response
86-
if (response.getAssertions() != null && !response.getAssertions().isEmpty()) {
87-
List<SubjectConfirmationType> subConfimationTypeList = response.getAssertions().get(0).getAssertion()
88-
.getSubject()
89-
.getConfirmation();
90-
for (SubjectConfirmationType subjectConfirmationType : subConfimationTypeList) {
91-
subject.addConfirmation(subjectConfirmationType);
74+
NameIDType nameID = new NameIDType();
75+
nameID.setFormat(URI.create(nameIdFormat));
76+
nameID.setValue(ppid);
77+
78+
SubjectType subject = new SubjectType();
79+
SubjectType.STSubType subType = new SubjectType.STSubType();
80+
subType.addBaseID(nameID);
81+
subject.setSubType(subType);
82+
83+
// Set NameID in the SAML response
84+
if (response.getAssertions() != null && !response.getAssertions().isEmpty()) {
85+
List<SubjectConfirmationType> subConfimationTypeList = response.getAssertions().get(0).getAssertion()
86+
.getSubject()
87+
.getConfirmation();
88+
for (SubjectConfirmationType subjectConfirmationType : subConfimationTypeList) {
89+
subject.addConfirmation(subjectConfirmationType);
90+
}
91+
response.getAssertions().get(0).getAssertion().setSubject(subject);
9292
}
93-
response.getAssertions().get(0).getAssertion().setSubject(subject);
9493
}
95-
}
96-
} else
97-
logger.errorf("Could not find %s mapper", PRIVACY_ZONE_MAPPER);
94+
} else
95+
logger.errorf("Could not find %s mapper", PRIVACY_ZONE_MAPPER);
96+
}
9897
return response;
9998
}
10099

@@ -139,6 +138,7 @@ public static ProtocolMapperRepresentation create(String name, String nameIdValu
139138
@Override
140139
public void transformAttributeStatement(AttributeStatementType attributeStatement, ProtocolMapperModel mappingModel,
141140
KeycloakSession keycloakSession, UserSessionModel userSession, AuthenticatedClientSessionModel clientSession) {
141+
// remove privacy_zone attribute
142142
List<ASTChoiceType> attributes = attributeStatement.getAttributes();
143143
for (int i = attributes.size(); i-- > 0;) {
144144
AttributeStatementType.ASTChoiceType attribute = attributes.get(i);

0 commit comments

Comments
 (0)