diff --git a/components/org.wso2.carbon.identity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/ClaimUtil.java b/components/org.wso2.carbon.identity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/ClaimUtil.java index ab7bdd3dd6f..231c42031d5 100644 --- a/components/org.wso2.carbon.identity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/ClaimUtil.java +++ b/components/org.wso2.carbon.identity.oauth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/ClaimUtil.java @@ -47,6 +47,7 @@ import org.wso2.carbon.identity.oauth2.dto.OAuth2TokenValidationResponseDTO; import org.wso2.carbon.identity.oauth2.internal.OAuth2ServiceComponentHolder; import org.wso2.carbon.identity.oauth2.model.AccessTokenDO; +import org.wso2.carbon.identity.oauth2.util.AuthzUtil; import org.wso2.carbon.identity.oauth2.util.OAuth2Util; import org.wso2.carbon.identity.openidconnect.OIDCClaimUtil; import org.wso2.carbon.user.api.RealmConfiguration; @@ -165,8 +166,32 @@ public static Map getClaimsFromUserStore(OAuth2TokenValidationRe spToLocalClaimMappings = ClaimMetadataHandler.getInstance().getMappingsMapFromOtherDialectToCarbon (SP_DIALECT, null, userTenantDomain, true); - realm = getUserRealm(null, userTenantDomain); - Map userClaims = getUserClaimsFromUserStore(userId, realm, claimURIList); + Map userClaims; + AuthenticatedUser authenticatedUser = accessTokenDO.getAuthzUser(); + if (!StringUtils.equals(authenticatedUser.getUserResidentOrganization(), + authenticatedUser.getAccessingOrganization()) && + StringUtils.isNotEmpty(AuthzUtil.getUserIdOfAssociatedUser(authenticatedUser))) { + authenticatedUser.setSharedUserId(AuthzUtil.getUserIdOfAssociatedUser(authenticatedUser)); + authenticatedUser.setUserSharedOrganizationId(authenticatedUser + .getAccessingOrganization()); + } + if (OIDCClaimUtil.isSharedUserProfileResolverEnabled() && + OIDCClaimUtil.isSharedUserAccessingSharedOrg(authenticatedUser) && + StringUtils.isNotEmpty(authenticatedUser.getSharedUserId())) { + String userAccessingTenantDomain = + OIDCClaimUtil.resolveTenantDomain(authenticatedUser.getAccessingOrganization()); + String sharedUserId = authenticatedUser.getSharedUserId(); + realm = getUserRealm(null, userAccessingTenantDomain); + try { + FrameworkUtils.startTenantFlow(userAccessingTenantDomain); + userClaims = getUserClaimsFromUserStore(sharedUserId, realm, claimURIList); + } finally { + FrameworkUtils.endTenantFlow(); + } + } else { + realm = getUserRealm(null, userTenantDomain); + userClaims = getUserClaimsFromUserStore(userId, realm, claimURIList); + } if (isNotEmpty(userClaims)) { for (Map.Entry entry : userClaims.entrySet()) { diff --git a/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java b/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java index 5cee4478ea0..7b25f075ed4 100644 --- a/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java +++ b/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/openidconnect/OIDCClaimUtil.java @@ -48,6 +48,7 @@ import org.wso2.carbon.identity.oauth2.internal.OAuth2ServiceComponentHolder; import org.wso2.carbon.identity.oauth2.util.OAuth2Util; import org.wso2.carbon.identity.openidconnect.internal.OpenIDConnectServiceComponentHolder; +import org.wso2.carbon.identity.organization.management.organization.user.sharing.util.OrganizationSharedUserUtil; import org.wso2.carbon.identity.organization.management.service.exception.OrganizationManagementException; import org.wso2.carbon.user.api.UserRealm; import org.wso2.carbon.user.api.UserStoreException; @@ -484,7 +485,28 @@ public static Map getUserClaimsInOIDCDialect(ServiceProvider ser claimURIList.remove(APP_ROLES_CLAIM); appRoleClaimRequested = true; } - Map userClaims = getUserClaimsInLocalDialect(fullQualifiedUsername, realm, claimURIList); + + Map userClaims; + if (isSharedUserProfileResolverEnabled() && isSharedUserAccessingSharedOrg(authenticatedUser) && + StringUtils.isNotEmpty(authenticatedUser.getSharedUserId())) { + String userAccessingTenantDomain = resolveTenantDomain(authenticatedUser.getAccessingOrganization()); + AbstractUserStoreManager userStoreManager = + (AbstractUserStoreManager) OAuthComponentServiceHolder.getInstance().getRealmService() + .getTenantUserRealm(IdentityTenantUtil.getTenantId(userAccessingTenantDomain)) + .getUserStoreManager(); + String fullQualifiedSharedUsername = userStoreManager.getUser(authenticatedUser.getSharedUserId(), null) + .getFullQualifiedUsername(); + realm = IdentityTenantUtil.getRealm(userAccessingTenantDomain, fullQualifiedSharedUsername); + + try { + FrameworkUtils.startTenantFlow(userAccessingTenantDomain); + userClaims = getUserClaimsInLocalDialect(fullQualifiedUsername, realm, claimURIList); + } finally { + FrameworkUtils.endTenantFlow(); + } + } else { + userClaims = getUserClaimsInLocalDialect(fullQualifiedUsername, realm, claimURIList); + } if (roleClaimRequested || appRoleClaimRequested) { String[] appAssocatedRolesOfUser = getAppAssociatedRolesOfUser(authenticatedUser, @@ -599,7 +621,7 @@ private static void setAppRoleClaimInLocalDialect(Map userClaims } } - private static boolean isSharedUserAccessingSharedOrg(AuthenticatedUser authenticatedUser) { + public static boolean isSharedUserAccessingSharedOrg(AuthenticatedUser authenticatedUser) { return StringUtils.isNotEmpty(authenticatedUser.getUserSharedOrganizationId()) && StringUtils.isNotEmpty(authenticatedUser.getAccessingOrganization()) && @@ -607,6 +629,28 @@ private static boolean isSharedUserAccessingSharedOrg(AuthenticatedUser authenti authenticatedUser.getAccessingOrganization()); } + /** + * Resolve the tenant domain of the organization. + * + * @param organizationId Organization Id. + * @return Tenant domain of the organization. + * @throws OrganizationManagementException If an error occurred while resolving the tenant domain. + */ + public static String resolveTenantDomain(String organizationId) throws OrganizationManagementException { + + return OAuthComponentServiceHolder.getInstance().getOrganizationManager().resolveTenantDomain(organizationId); + } + + /** + * Check whether the shared user profile resolver is enabled. + * + * @return True if the shared user profile resolver is enabled. + */ + public static boolean isSharedUserProfileResolverEnabled() { + + return OrganizationSharedUserUtil.isSharedUserProfileResolverEnabled(); + } + private static void addSharedUserGroupsFromSharedOrganization(AuthenticatedUser authenticatedUser, Map userClaims) throws OrganizationManagementException, UserStoreException, IdentityException { diff --git a/pom.xml b/pom.xml index b4e896fb9c8..5087afb395d 100644 --- a/pom.xml +++ b/pom.xml @@ -967,12 +967,12 @@ [1.0.1, 2.0.0) - 7.7.112 + 7.7.114 [5.25.234, 8.0.0) [2.0.0, 3.0.0) - 1.4.7 + 1.4.70-SNAPSHOT [1.1.14, 2.0.0)