Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FIX OIDC token selection for sourcing "member_of" or "roles" claim #99

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

FIX OIDC token selection for sourcing "member_of" or "roles" claim #99

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e56b2df
change user function to check if member_of is present in access_token…
Nov 29, 2024
3aa8c74
also look for "roles" in the acces_token
Nov 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions app/models/oic_session.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ def check_keycloak_role(role)
if user["resource_access"].present? && user["resource_access"][client_config['client_id']].present?
kc_is_in_role = user["resource_access"][client_config['client_id']]["roles"].include?(role)
end
return true if kc_is_in_role
return true if kc_is_in_role
end

def authorized?
Expand All @@ -152,7 +152,7 @@ def authorized?

if client_config['group'].present?
return true if user["member_of"].present? && user["member_of"].include?(client_config['group'])
return true if user["roles"].present? && user["roles"].include?(client_config['group']) || user["roles"].include?(client_config['admin_group'])
return true if user["roles"].present? && user["roles"].include?(client_config['group']) || user["roles"].include?(client_config['admin_group'])
end

return false
Expand All @@ -163,22 +163,28 @@ def admin?
if user["member_of"].present?
return true if user["member_of"].include?(client_config['admin_group'])
end
if user["roles"].present?
if user["roles"].present?
return true if user["roles"].include?(client_config['admin_group'])
end
# keycloak way...
return true if check_keycloak_role client_config['admin_group']
end

return false
end

def user
if access_token? # keycloak way...
@user = JSON::parse(Base64::decode64(access_token.split('.')[1]))
else
@user = JSON::parse(Base64::decode64(id_token.split('.')[1]))
# user info from access_token, the keycloak way...
if access_token?
token = JSON::parse(Base64::decode64(access_token.split('.')[1]))
if token["member_of"].present? || token["roles"].present?
@user = token
return @user
end
end

# user info from id_token, the regular way...
@user = JSON.parse(Base64.decode64(id_token.split('.')[1]))
return @user
end

Expand Down Expand Up @@ -235,7 +241,7 @@ def end_session_query
'session_state' => session_state,
'post_logout_redirect_uri' => "#{host_name}/oic/local_logout",
}
if id_token.present?
if id_token.present?
query['id_token_hint'] = id_token
end
return query
Expand Down