-
Notifications
You must be signed in to change notification settings - Fork 936
Description
Describe the issue:
With the feature introduced with #9293, it is allowed to set temporary claims for authentication flows from the adaptive authentication flows. As per the implementation, this is supposed to work with both federated and local users.
For the local users, the temporary claims are put into all local claims map [1] overriding the userstore claims and then SP claim mapping is done. But for the federated users, the temporary claims are put into the federated claims map [2] , and IDP and SP claim mapping is done. Therefore, if you have different claim mappings for different IDPs used in a single service provider, it is not possible to set temporary claims to comply with all of them since temporary claims need to be set with federated claim URIs.
How to reproduce:
- Configure a service provider with the following adaptive script and add the nickname as a requested claim
var onLoginRequest = function(context) {
executeStep(1, {
onSuccess: function(context) {
user = context.steps[1].subject;
if (context.steps[1].idp === 'LOCAL') {
Log.info('local login flow');
user.claims['http://wso2.org/claims/nickname'] = 'local login flow';
} else {
Log.info('federated login flow');
user.claims['http://wso2.org/claims/nickname'] = 'federated login flow';
}
}
});
};
- Add basic and a federated authentication with OIDC for the first step
- Now the SP will receive the nickname in the local authentication flow, but not in the federated flow
Expected behavior:
It should allow setting temporary claims in the same way (using local claim URIs) despite the authenticator used
Environment information
- Product Version: IS 5.11.0
[1] https://github.com/wso2/carbon-identity-framework/blob/be8975b91fe2b12f938512753f11da17cb71b54b/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/handler/claims/impl/DefaultClaimHandler.java#L482
[2] https://github.com/wso2/carbon-identity-framework/blob/be8975b91fe2b12f938512753f11da17cb71b54b/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/handler/claims/impl/DefaultClaimHandler.java#L169