Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add claim path delimiter configuration for JwtGrantedAuthoritiesConverter #16603

Open
BeforeOleg opened this issue Feb 14, 2025 · 0 comments
Open
Labels
status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement

Comments

@BeforeOleg
Copy link

Expected Behavior
JwtGrantedAuthoritiesConverter should provide an ability to access authorities as nested claim.
As well as it should be included into OAuth2ResourceServerJwtConfiguration.JwtConverterConfiguration.

private Collection<String> getAuthorities(Jwt jwt) {
    String claimName = getAuthoritiesClaimName(jwt);
    ...
    Object authorities = getClaim(jwt, claimName);
    ...
}


private static Object getClaim(Jwt jwt, String claimName) {
    if (this.authoritiesClaimNamePathDelimiter != null) {
        String[] path = claimName.split(this.authoritiesClaimNamePathDelimiter);
        if (path.length > 1) {
            return getNestedClaim(jwt.getClaims(), path);
        }
    }
    return jwt.getClaim(claimName);
}

private static Object getNestedClaim(Map<String, Object> map, String[] path) {
    Object current = map;
    for (String key : path) {
        if (current instanceof Map) {
            current = map.get(key);
        } else {
            return null;
        }
    }
    return current;
}

Current Behavior
Does not provide ability to access nested claims.

private Collection<String> getAuthorities(Jwt jwt) {
    String claimName = getAuthoritiesClaimName(jwt);
    ...
    Object authorities = jwt.getClaim(claimName);
    ...
}

Context
What are you trying to accomplish?
I want to have an ability to access authorities stored in the custom property:

{
  "realm_access": {
    "roles": [
      "admin",
      "manager",
      "user"
    ]
  }
}

What other alternatives have you considered? Are you aware of any workarounds?
Obviously, I can create a custom converter or store claims in the root level of jwt.
However, I find it useful to have it included into the framework.

@BeforeOleg BeforeOleg added status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement labels Feb 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-triage An issue we've not yet triaged type: enhancement A general enhancement
Projects
None yet
Development

No branches or pull requests

1 participant