-
Notifications
You must be signed in to change notification settings - Fork 374
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set parent user's user store domain in shared token revoke flow #2664
base: master
Are you sure you want to change the base?
Set parent user's user store domain in shared token revoke flow #2664
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2664 +/- ##
============================================
+ Coverage 55.52% 56.32% +0.80%
- Complexity 8249 8285 +36
============================================
Files 632 632
Lines 48572 47001 -1571
Branches 8933 8783 -150
============================================
- Hits 26970 26475 -495
+ Misses 17732 16741 -991
+ Partials 3870 3785 -85
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
...s/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthUtil.java
Outdated
Show resolved
Hide resolved
...s/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthUtil.java
Outdated
Show resolved
Hide resolved
c534d4f
87b1244
to
c534d4f
Compare
PR builder started |
PR builder completed |
PR builder started |
PR builder completed |
Proposed changes in this pull request
Purpose
When revoking an access token in a shared user flow, the authorized user's User Store Domain is set to the shared user's domain. Therefore, when retrieving the clientIDs from here, it will only retrieve the clientIDs associated with the shared user's User Store Domain.
However, when creating access tokens for shared users the User Store Domain of the parent user is used here and here. Hence these tokens are not getting revoked.
Approach
Hence the access token revoke logic for shared user flow has to be improved to handle the user's domain correctly which will eventually detect all the clientIDs issued.
This is an alternative approach to the fix wso2-extensions/identity-oauth2-grant-organization-switch#38. In which we amend the user store domain when the token is issued. Which would lead to user store mismatch between the token and the actual user. Here, we change the logic in the token revoke method.