Examples with ConsentClaimsData org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentClaimsData used on opensource projects

Example 1 with ConsentClaimsData

use of org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentClaimsData in project carbon-identity-framework by wso2.

the class ConsentMgtPostAuthnHandler method handlePreConsent.

protected PostAuthnHandlerFlowStatus handlePreConsent(HttpServletRequest request, HttpServletResponse response, AuthenticationContext context) throws PostAuthenticationFailedException {
    String spName = context.getSequenceConfig().getApplicationConfig().getApplicationName();
    Map<String, String> claimMappings = context.getSequenceConfig().getApplicationConfig().getClaimMappings();
    // Should be removed once the issue is fixed
    if (SP_NAME_DEFAULT.equalsIgnoreCase(spName)) {
        return PostAuthnHandlerFlowStatus.SUCCESS_COMPLETED;
    }
    AuthenticatedUser authenticatedUser = getAuthenticatedUser(context);
    ServiceProvider serviceProvider = getServiceProvider(context);
    try {
        ConsentClaimsData consentClaimsData = getSSOConsentService().getConsentRequiredClaimsWithExistingConsents(serviceProvider, authenticatedUser);
        if (isDebugEnabled()) {
            String message = String.format("Retrieving required consent data of user: %s for service " + "provider: %s in tenant domain: %s.", authenticatedUser.getAuthenticatedSubjectIdentifier(), serviceProvider.getApplicationName(), getSPTenantDomain(serviceProvider));
            logDebug(message);
        }
        removeClaimsWithoutConsent(context, consentClaimsData);
        // Remove the claims which dont have values given by the user.
        consentClaimsData.setRequestedClaims(removeConsentRequestedNullUserAttributes(consentClaimsData.getRequestedClaims(), authenticatedUser.getUserAttributes(), claimMappings));
        if (hasConsentForRequiredClaims(consentClaimsData)) {
            if (isDebugEnabled()) {
                String message = String.format("Required consent data is empty for user: %s for service " + "provider: %s in tenant domain: %s. Post authentication completed.", authenticatedUser.getAuthenticatedSubjectIdentifier(), serviceProvider.getApplicationName(), getSPTenantDomain(serviceProvider));
                logDebug(message);
            }
            return PostAuthnHandlerFlowStatus.SUCCESS_COMPLETED;
        } else {
            String mandatoryLocalClaims = buildConsentClaimString(consentClaimsData.getMandatoryClaims());
            String requestedLocalClaims = buildConsentClaimString(consentClaimsData.getRequestedClaims());
            if (isDebugEnabled()) {
                String message = "Require consent for mandatory claims: %s, requested claims: %s, from user: %s " + "for service provider: %s in tenant domain: %s.";
                message = String.format(message, consentClaimsData.getMandatoryClaims(), consentClaimsData.getRequestedClaims(), authenticatedUser.getAuthenticatedSubjectIdentifier(), serviceProvider.getApplicationName(), getSPTenantDomain(serviceProvider));
                logDebug(message);
            }
            redirectToConsentPage(response, context, requestedLocalClaims, mandatoryLocalClaims);
            setConsentPoppedUpState(context);
            context.addParameter(CONSENT_CLAIM_META_DATA, consentClaimsData);
            return PostAuthnHandlerFlowStatus.INCOMPLETE;
        }
    } catch (SSOConsentDisabledException e) {
        return PostAuthnHandlerFlowStatus.SUCCESS_COMPLETED;
    } catch (SSOConsentServiceException e) {
        String error = String.format("Error occurred while retrieving consent data of user: %s for service " + "provider: %s in tenant domain: %s.", authenticatedUser.getAuthenticatedSubjectIdentifier(), serviceProvider.getApplicationName(), getSPTenantDomain(serviceProvider));
        throw new PostAuthenticationFailedException("Authentication failed. Error occurred while processing user " + "consent.", error, e);
    }
}

Example 2 with ConsentClaimsData

use of org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentClaimsData in project carbon-identity-framework by wso2.

the class SSOConsentServiceImpl method getConsentRequiredClaimData.

private ConsentClaimsData getConsentRequiredClaimData(List<String> mandatoryClaims, List<String> requestedClaims, String tenantDomain) throws SSOConsentServiceException {
    ConsentClaimsData consentClaimsData = new ConsentClaimsData();
    try {
        List<LocalClaim> localClaims = getClaimMetadataManagementService().getLocalClaims(tenantDomain);
        List<ClaimMetaData> mandatoryClaimsMetaData = new ArrayList<>();
        List<ClaimMetaData> requestedClaimsMetaData = new ArrayList<>();
        int claimId = 0;
        if (isNotEmpty(localClaims)) {
            for (LocalClaim localClaim : localClaims) {
                if (isAllRequiredClaimsChecked(mandatoryClaims, requestedClaims)) {
                    break;
                }
                String claimURI = localClaim.getClaimURI();
                if (mandatoryClaims.remove(claimURI)) {
                    ClaimMetaData claimMetaData = buildClaimMetaData(claimId, localClaim, claimURI);
                    mandatoryClaimsMetaData.add(claimMetaData);
                    claimId++;
                } else if (requestedClaims.remove(claimURI)) {
                    ClaimMetaData claimMetaData = buildClaimMetaData(claimId, localClaim, claimURI);
                    requestedClaimsMetaData.add(claimMetaData);
                    claimId++;
                }
            }
        }
        if (isNotEmpty(mandatoryClaims)) {
            for (String claimUri : mandatoryClaims) {
                ClaimMetaData claimMetaData = buildClaimMetaData(claimId, claimUri);
                mandatoryClaimsMetaData.add(claimMetaData);
                claimId++;
            }
        }
        if (isNotEmpty(requestedClaims)) {
            for (String claimUri : mandatoryClaims) {
                ClaimMetaData claimMetaData = buildClaimMetaData(claimId, claimUri);
                requestedClaimsMetaData.add(claimMetaData);
                claimId++;
            }
        }
        consentClaimsData.setMandatoryClaims(mandatoryClaimsMetaData);
        consentClaimsData.setRequestedClaims(requestedClaimsMetaData);
    } catch (ClaimMetadataException e) {
        throw new SSOConsentServiceException("Error while retrieving local claims", "Error occurred while " + "retrieving local claims for tenant: " + tenantDomain, e);
    }
    return consentClaimsData;
}

Example 3 with ConsentClaimsData

use of org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentClaimsData in project carbon-identity-framework by wso2.

the class SSOConsentServiceImpl method processConsent.

@Override
public void processConsent(List<Integer> consentApprovedClaimIds, ServiceProvider serviceProvider, AuthenticatedUser authenticatedUser, ConsentClaimsData consentClaimsData, boolean overrideExistingConsent) throws SSOConsentServiceException {
    if (!isSSOConsentManagementEnabled(serviceProvider)) {
        String message = "Consent management for SSO is disabled.";
        throw new SSOConsentDisabledException(message, message);
    }
    if (isDebugEnabled()) {
        logDebug("User: " + authenticatedUser.getAuthenticatedSubjectIdentifier() + " has approved consent.");
    }
    UserConsent userConsent = processUserConsent(consentApprovedClaimIds, consentClaimsData);
    if (isEmpty(userConsent.getApprovedClaims()) && isEmpty(userConsent.getDisapprovedClaims())) {
        if (isDebugEnabled()) {
            logDebug("User: " + authenticatedUser.getAuthenticatedSubjectIdentifier() + " has not provided new " + "approved/disapproved consent. Hence skipping the consent progress.");
        }
        return;
    }
    String subject = buildSubjectWithUserStoreDomain(authenticatedUser);
    List<ClaimMetaData> claimsWithConsent;
    List<ClaimMetaData> claimsDeniedConsent;
    if (!overrideExistingConsent) {
        String spName = serviceProvider.getApplicationName();
        String spTenantDomain = getSPTenantDomain(serviceProvider);
        Receipt receipt = getConsentReceiptOfUser(serviceProvider, authenticatedUser, spName, spTenantDomain, subject);
        claimsWithConsent = getUserRequestedClaims(receipt, userConsent, true);
        claimsDeniedConsent = getUserRequestedClaims(receipt, userConsent, false);
    } else {
        claimsWithConsent = userConsent.getApprovedClaims();
        claimsDeniedConsent = userConsent.getDisapprovedClaims();
    }
    String spTenantDomain = getSPTenantDomain(serviceProvider);
    String subjectTenantDomain = authenticatedUser.getTenantDomain();
    if (isNotEmpty(claimsWithConsent) || isNotEmpty(claimsDeniedConsent)) {
        addReceipt(subject, subjectTenantDomain, serviceProvider, spTenantDomain, claimsWithConsent, claimsDeniedConsent);
    }
}

Example 4 with ConsentClaimsData

use of org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentClaimsData in project carbon-identity-framework by wso2.

the class SSOConsentServiceImplTest method testGetConsentRequiredClaimsWithExistingConsents.

@Test
public void testGetConsentRequiredClaimsWithExistingConsents() throws Exception {
    ServiceProvider serviceProvider = new ServiceProvider();
    serviceProvider.setApplicationName("Travelocity.com");
    User user = new User();
    user.setTenantDomain("carbon.super");
    user.setUserStoreDomain("PRIMARY");
    serviceProvider.setOwner(user);
    ClaimConfig claimConfig = new ClaimConfig();
    Claim tempClaim1 = new Claim();
    tempClaim1.setClaimUri("http://wso2.org/claims/organization");
    ClaimMapping tempClaimMapping1 = new ClaimMapping();
    tempClaimMapping1.setRequested(true);
    tempClaimMapping1.setMandatory(false);
    tempClaimMapping1.setLocalClaim(tempClaim1);
    tempClaimMapping1.setRemoteClaim(tempClaim1);
    Claim tempClaim2 = new Claim();
    tempClaim2.setClaimUri("http://wso2.org/claims/country");
    ClaimMapping tempClaimMapping2 = new ClaimMapping();
    tempClaimMapping2.setRequested(true);
    tempClaimMapping2.setMandatory(true);
    tempClaimMapping2.setLocalClaim(tempClaim2);
    tempClaimMapping2.setRemoteClaim(tempClaim2);
    claimConfig.setClaimMappings(new ClaimMapping[] { tempClaimMapping1, tempClaimMapping2 });
    serviceProvider.setClaimConfig(claimConfig);
    LocalAndOutboundAuthenticationConfig localAndOutboundAuthenticationConfig = new LocalAndOutboundAuthenticationConfig();
    localAndOutboundAuthenticationConfig.setSubjectClaimUri(null);
    serviceProvider.setLocalAndOutBoundAuthenticationConfig(localAndOutboundAuthenticationConfig);
    AuthenticatedUser authenticatedUser = getAuthenticatedUser();
    mockStatic(IdentityUtil.class);
    when(IdentityUtil.getProperty("Consent.PromptSubjectClaimRequestedConsent")).thenReturn(null);
    mockCarbonContextForTenant();
    mockStatic(FrameworkServiceDataHolder.class);
    when(FrameworkServiceDataHolder.getInstance()).thenReturn(frameworkServiceDataHolder);
    setConsentManagerConfigurationHolder();
    RealmService realmService = mock(RealmService.class);
    configurationHolder.setRealmService(realmService);
    ConsentManager consentManager = new ConsentManagerImpl(configurationHolder);
    when(frameworkServiceDataHolder.getConsentManager()).thenReturn(consentManager);
    mockStatic(ConsentUtils.class);
    when(ConsentUtils.getTenantDomainFromCarbonContext()).thenReturn("carbon.super");
    mockRealmService(realmService);
    when(frameworkServiceDataHolder.getClaimMetadataManagementService()).thenReturn(claimMetadataManagementService);
    List<LocalClaim> localClaims = new ArrayList<>();
    LocalClaim localClaim = new LocalClaim("http://wso2.org/claims/country");
    LocalClaim localClaim2 = new LocalClaim("http://wso2.org/claims/organization");
    localClaims.add(localClaim);
    localClaims.add(localClaim2);
    when(claimMetadataManagementService.getLocalClaims(anyString())).thenReturn(localClaims);
    ConsentClaimsData consentClaimsData = ssoConsentService.getConsentRequiredClaimsWithExistingConsents(serviceProvider, authenticatedUser);
    assertEquals(consentClaimsData.getRequestedClaims().get(0).getClaimUri(), "http://wso2.org/claims/organization", "Incorrect requested claim URI");
    assertEquals(consentClaimsData.getMandatoryClaims().get(0).getClaimUri(), "http://wso2.org/claims/country", "Incorrect mandatory claim URI");
    assertNotNull(consentClaimsData.getMandatoryClaims().get(0).getClaimUri());
}

Example 5 with ConsentClaimsData

use of org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.consent.ConsentClaimsData in project identity-inbound-auth-oauth by wso2-extensions.

the class OAuth2AuthzEndpoint method handlePostConsent.

private void handlePostConsent(OAuthMessage oAuthMessage) throws ConsentHandlingFailedException {
    OAuth2Parameters oauth2Params = getOauth2Params(oAuthMessage);
    String tenantDomain = EndpointUtil.getSPTenantDomainFromClientId(oauth2Params.getClientId());
    setSPAttributeToRequest(oAuthMessage.getRequest(), oauth2Params.getApplicationName(), tenantDomain);
    String spTenantDomain = oauth2Params.getTenantDomain();
    AuthenticatedUser loggedInUser = getLoggedInUser(oAuthMessage);
    String clientId = oauth2Params.getClientId();
    ServiceProvider serviceProvider;
    if (log.isDebugEnabled()) {
        log.debug("Initiating post user consent handling for user: " + loggedInUser.toFullQualifiedUsername() + " for client_id: " + clientId + " of tenantDomain: " + spTenantDomain);
    }
    try {
        if (isConsentHandlingFromFrameworkSkipped(oauth2Params)) {
            if (log.isDebugEnabled()) {
                log.debug("Consent handling from framework skipped for client_id: " + clientId + " of tenantDomain: " + spTenantDomain + " for user: " + loggedInUser.toFullQualifiedUsername() + ". " + "Therefore handling post consent is not applicable.");
            }
            if (LoggerUtils.isDiagnosticLogsEnabled()) {
                Map<String, Object> params = new HashMap<>();
                params.put("clientId", clientId);
                Map<String, Object> configs = new HashMap<>();
                configs.put("skipConsent", "true");
                LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, params, OAuthConstants.LogConstants.SUCCESS, "Consent is disabled for the OAuth client.", "handle-consent", configs);
            }
            return;
        }
        List<Integer> approvedClaimIds = getUserConsentClaimIds(oAuthMessage);
        serviceProvider = getServiceProvider(clientId);
        /*
                With the current implementation of the SSOConsentService we need to send back the original
                ConsentClaimsData object we got during pre consent stage. Currently we are repeating the API call
                during post consent handling to get the original ConsentClaimsData object (Assuming there is no
                change in SP during pre-consent and post-consent).

                The API on the SSO Consent Service will be improved to avoid having to send the original
                ConsentClaimsData object.
             */
        ConsentClaimsData value = getConsentRequiredClaims(loggedInUser, serviceProvider, oauth2Params);
        /*
                It is needed to pitch the consent required claims with the OIDC claims. otherwise the consent of the
                the claims which are not in the OIDC claims will be saved as consent denied.
            */
        if (value != null) {
            // Remove the claims which dont have values given by the user.
            value.setRequestedClaims(removeConsentRequestedNullUserAttributes(value.getRequestedClaims(), loggedInUser.getUserAttributes(), spTenantDomain));
            List<ClaimMetaData> requestedOidcClaimsList = getRequestedOidcClaimsList(value, oauth2Params, spTenantDomain);
            value.setRequestedClaims(requestedOidcClaimsList);
        }
        // Call framework and create the consent receipt.
        if (log.isDebugEnabled()) {
            log.debug("Creating user consent receipt for user: " + loggedInUser.toFullQualifiedUsername() + " for client_id: " + clientId + " of tenantDomain: " + spTenantDomain);
        }
        Map<String, Object> params;
        if (hasPromptContainsConsent(oauth2Params)) {
            if (LoggerUtils.isDiagnosticLogsEnabled()) {
                params = new HashMap<>();
                params.put("clientId", clientId);
                params.put("prompt", oauth2Params.getPrompt());
                LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, params, OAuthConstants.LogConstants.SUCCESS, null, "hand-over-to-consent-service", null);
            }
            getSSOConsentService().processConsent(approvedClaimIds, serviceProvider, loggedInUser, value, true);
        } else {
            if (LoggerUtils.isDiagnosticLogsEnabled()) {
                params = new HashMap<>();
                params.put("clientId", clientId);
                params.put("prompt", oauth2Params.getPrompt());
                LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, params, OAuthConstants.LogConstants.SUCCESS, null, "hand-over-to-consent-service", null);
            }
            getSSOConsentService().processConsent(approvedClaimIds, serviceProvider, loggedInUser, value, false);
        }
    } catch (OAuthSystemException | SSOConsentServiceException e) {
        if (LoggerUtils.isDiagnosticLogsEnabled()) {
            LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, null, OAuthConstants.LogConstants.FAILED, "System error occurred.", "process-consent", null);
        }
        String msg = "Error while processing consent of user: " + loggedInUser.toFullQualifiedUsername() + " for " + "client_id: " + clientId + " of tenantDomain: " + spTenantDomain;
        throw new ConsentHandlingFailedException(msg, e);
    } catch (ClaimMetadataException e) {
        if (LoggerUtils.isDiagnosticLogsEnabled()) {
            LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, null, OAuthConstants.LogConstants.FAILED, String.format("Error occurred while getting " + "claim mappings for %s.", OIDC_DIALECT), "process-consent", null);
        }
        throw new ConsentHandlingFailedException("Error while getting claim mappings for " + OIDC_DIALECT, e);
    } catch (RequestObjectException e) {
        if (LoggerUtils.isDiagnosticLogsEnabled()) {
            LoggerUtils.triggerDiagnosticLogEvent(OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, null, OAuthConstants.LogConstants.FAILED, String.format("Error occurred while getting essential claims for the session data key : %s.", oauth2Params.getSessionDataKey()), "process-consent", null);
        }
        throw new ConsentHandlingFailedException("Error while getting essential claims for the session data key " + ": " + oauth2Params.getSessionDataKey(), e);
    }
}