Fix provisioning roles as an attribute at JIT provisioning.
Resolves wso2/product-is#3098
package org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl;
import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -323,6 +324,8 @@ public class DefaultStepBasedSequenceHandler implements StepBasedSequenceHandler
localClaimValues.put(FrameworkConstants.ASSOCIATED_ID, originalExternalIdpSubjectValueForThisStep);
localClaimValues.put(FrameworkConstants.IDP_ID, stepConfig.getAuthenticatedIdP());
+ // Remove role claim from local claims as roles are specifically handled.
+ localClaimValues.remove(getLocalClaimUriMappedForIdPRoleClaim(externalIdPConfig));
handleJitProvisioning(originalExternalIdpSubjectValueForThisStep, context,
identityProviderMappedUserRolesUnmappedExclusive, localClaimValues);
@@ -773,4 +776,33 @@ public class DefaultStepBasedSequenceHandler implements StepBasedSequenceHandler
context.setCurrentAuthenticator(null);
}
+ /**
+ * Returns the local claim uri that is mapped for the IdP role claim uri configured.
+ * If no role claim uri is configured for the IdP returns the local role claim 'http://wso2.org/claims/role'.
+ *
+ * @param externalIdPConfig IdP configurations
+ * @return local claim uri mapped for the IdP role claim uri.
+ * @throws FrameworkException
+ */
+ protected String getLocalClaimUriMappedForIdPRoleClaim(ExternalIdPConfig externalIdPConfig) throws
+ FrameworkException {
+ // get external identity provider role claim uri.
+ String idpRoleClaimUri = externalIdPConfig.getRoleClaimUri();
+ if (StringUtils.isNotBlank(idpRoleClaimUri)) {
+ // Iterate over IdP claim mappings and check for the local claim that is mapped for the remote IdP role
+ // claim uri configured.
+ ClaimMapping[] idpToLocalClaimMapping = externalIdPConfig.getClaimMappings();
+ if (!ArrayUtils.isEmpty(idpToLocalClaimMapping)) {
+ for (ClaimMapping mapping : idpToLocalClaimMapping) {
+ if (mapping.getRemoteClaim() != null && idpRoleClaimUri.equals(mapping.getRemoteClaim()
+ .getClaimUri())) {
+ return mapping.getLocalClaim().getClaimUri();
+ }
+ }
+ }
+ }
+
+ return FrameworkConstants.LOCAL_ROLE_CLAIM_URI;
+ }
+
}
