Skip to content

Add option to include the organization name in the organization claims #51430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
netroutines wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add option to include the organization name in the organization claims #51430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions core/src/main/java/org/keycloak/OAuth2Constants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,7 @@ public interface OAuth2Constants {

String ORGANIZATION = "organization";
String ORGANIZATION_ID = "id";
String ORGANIZATION_NAME = "name";

String UI_LOCALES_PARAM = "ui_locales";

Expand Down
Binary file modified docs/documentation/server_admin/images/organizations-add-org-attrs-in-claim.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
3 changes: 2 additions & 1 deletion ...ocumentation/server_admin/topics/organizations/mapping-organization-claims.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ As a result, the token will contain a claim as follows:
"organization": {
"testcorp": {
"id": "42c3e46f-2477-44d7-a85b-d3b43f6b31fa",
"name": "Organization Name",
"attr1": [
"value1"
]
Expand All @@ -25,7 +26,7 @@ to authorize access to protected resources based on the organization where the u

The `organization` scope is a built-in optional client scope at the realm. Therefore, this scope is added to any client created in the realm by default. It also defines the `Organization Membership` mapper that controls how the organization membership information is mapped to the tokens.

NOTE: By default, the organization id and attributes are not included in the organization claim. To include them, edit the mapper and enable the *Add organization id* and *Add organization attributes* options, respectively.
NOTE: By default, the organization id, name and attributes are not included in the organization claim. To include them, edit the mapper and enable the *Add organization id*, *Add organization name* and *Add organization attributes* options, respectively.

.Including attributes in the organization claim
image:images/organizations-add-org-attrs-in-claim.png[alt="Including attributes in the organization claim"]
Expand Down
2 changes: 2 additions & 0 deletions js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3777,6 +3777,8 @@ addOrganizationAttributes.label=Add organization attributes
addOrganizationAttributes.help=If enabled, the organization attributes will be available for each organization mapped to the token.
addOrganizationId.label=Add organization id
addOrganizationId.help=If enabled, the organization id will be available for each organization mapped to the token.
addOrganizationName.label=Add organization name
addOrganizationName.help=If enabled, the organization name will be available for each organization mapped to the token.
addOrganizationDomain.label=Add organization domain
addOrganizationDomain.help=If enabled, the organization domain matching the user's email domain will be available for each organization mapped to the token.
addGroupRoleMappings.label=Add group role mappings
Expand Down
23 changes: 20 additions & 3 deletions ...in/java/org/keycloak/organization/protocol/mappers/oidc/OrganizationMembershipMapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ public class OrganizationMembershipMapper extends AbstractOIDCProtocolMapper imp
public static final String PROVIDER_ID = "oidc-organization-membership-mapper";
public static final String ADD_ORGANIZATION_ATTRIBUTES = "addOrganizationAttributes";
public static final String ADD_ORGANIZATION_ID = "addOrganizationId";
public static final String ADD_ORGANIZATION_NAME = "addOrganizationName";
public static final String ADD_ORGANIZATION_DOMAIN = "addOrganizationDomain";

@Override
Expand Down Expand Up @@ -89,6 +90,13 @@ public List<ProviderConfigProperty> getConfigProperties() {
property.setHelpText(ADD_ORGANIZATION_ID + ".help");
properties.add(property);
property = new ProviderConfigProperty();
property.setName(ADD_ORGANIZATION_NAME);
property.setLabel(ADD_ORGANIZATION_NAME + ".label");
property.setType(ProviderConfigProperty.BOOLEAN_TYPE);
property.setDefaultValue(Boolean.FALSE.toString());
property.setHelpText(ADD_ORGANIZATION_NAME + ".help");
properties.add(property);
property = new ProviderConfigProperty();
property.setName(ADD_ORGANIZATION_DOMAIN);
property.setLabel(ADD_ORGANIZATION_DOMAIN + ".label");
property.setType(ProviderConfigProperty.BOOLEAN_TYPE);
Expand Down Expand Up @@ -176,15 +184,19 @@ private Object resolveValue(ProtocolMapperModel model, UserModel user, List<Orga

Map<String, Object> claims = new HashMap<>();

// Add organization attributes first
// Add organization attributes first so built-in claims override custom attributes with the same names
if (isAddOrganizationAttributes(model)) {
claims.putAll(o.getAttributes());
}
// Add organization ID last so it overrides any custom "id" attribute

if (isAddOrganizationId(model)) {
claims.put(OAuth2Constants.ORGANIZATION_ID, o.getId());
}

if (isAddOrganizationName(model)) {
claims.put(OAuth2Constants.ORGANIZATION_NAME, o.getName());
}

if (isAddOrganizationDomain(model)) {
OrganizationDomainModel domain = Organizations.getMatchingDomain(Organizations.getEmailDomain(user.getEmail()), o);

Expand Down Expand Up @@ -220,9 +232,10 @@ public ProtocolMapperModel getEffectiveModel(KeycloakSession session, RealmModel
if (!OIDCAttributeMapperHelper.isMultivalued(copy)) {
config.put(ADD_ORGANIZATION_ATTRIBUTES, Boolean.FALSE.toString());
config.put(ADD_ORGANIZATION_ID, Boolean.FALSE.toString());
config.put(ADD_ORGANIZATION_NAME, Boolean.FALSE.toString());
}

if (isAddOrganizationAttributes(copy) || isAddOrganizationId(copy)) {
if (isAddOrganizationAttributes(copy) || isAddOrganizationId(copy) || isAddOrganizationName(copy)) {
config.put(JSON_TYPE, "JSON");
}

Expand Down Expand Up @@ -251,6 +264,10 @@ private boolean isAddOrganizationId(ProtocolMapperModel model) {
return Boolean.parseBoolean(model.getConfig().getOrDefault(ADD_ORGANIZATION_ID, Boolean.FALSE.toString()));
}

private boolean isAddOrganizationName(ProtocolMapperModel model) {
return Boolean.parseBoolean(model.getConfig().getOrDefault(ADD_ORGANIZATION_NAME, Boolean.FALSE.toString()));
}

private boolean isAddOrganizationDomain(ProtocolMapperModel model) {
return Boolean.parseBoolean(model.getConfig().getOrDefault(ADD_ORGANIZATION_DOMAIN, Boolean.FALSE.toString()));
}
Expand Down
52 changes: 52 additions & 0 deletions .../test/java/org/keycloak/tests/organization/mapper/OrganizationOIDCProtocolMapperTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1208,6 +1208,58 @@ public void testIncludeOrganizationId() throws Exception {
assertThat(organizations.get(organizationName).keySet().isEmpty(), is(true));
}

@Test
@SuppressWarnings("unchecked")
public void testIncludeOrganizationName() throws Exception {
OrganizationRepresentation orgRep = createOrganization();
OrganizationResource organization = realm.admin().organizations().get(orgRep.getId());

String organizationAlias = orgRep.getAlias();
String organizationDisplayName = "Organization Display Name";
orgRep.setName(organizationDisplayName);

try (Response updateResponse = organization.update(orgRep)) {
assertEquals(Status.NO_CONTENT.getStatusCode(), updateResponse.getStatus());
}

addMember(organization);
setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_NAME, Boolean.TRUE.toString());

oauth.client("direct-grant", "password");
oauth.scope("openid organization");

AccessTokenResponse response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
assertThat(response.getScope(), containsString("organization"));
AccessToken accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
Map<String, Map<String, String>> organizations = (Map<String, Map<String, String>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
assertThat(organizations.keySet(), hasItem(organizationAlias));
assertThat(organizations.get(organizationAlias).keySet(), hasItem("name"));
assertThat(organizations.get(organizationAlias).get("name"), equalTo(organizationDisplayName));

// When the name is added to tokens, the claim type is JSON
// regardless of the value set in the mapper configuration.
setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_NAME, Boolean.TRUE.toString());
setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "boolean");
response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
organizations = (Map<String, Map<String, String>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
assertThat(organizations.keySet(), hasItem(organizationAlias));
assertThat(organizations.get(organizationAlias).keySet(), hasItem("name"));
assertThat(organizations.get(organizationAlias).get("name"), equalTo(organizationDisplayName));

// Disabling the option should result in no name in the claim.
setMapperConfig(OrganizationMembershipMapper.ADD_ORGANIZATION_NAME, Boolean.FALSE.toString());
setMapperConfig(OIDCAttributeMapperHelper.JSON_TYPE, "JSON");
response = oauth.doPasswordGrantRequest(memberEmail, memberPassword);
accessToken = TokenVerifier.create(response.getAccessToken(), AccessToken.class).getToken();
assertThat(accessToken.getOtherClaims().keySet(), hasItem(OAuth2Constants.ORGANIZATION));
organizations = (Map<String, Map<String, String>>) accessToken.getOtherClaims().get(OAuth2Constants.ORGANIZATION);
assertThat(organizations.keySet(), hasItem(organizationAlias));
assertThat(organizations.get(organizationAlias).keySet().isEmpty(), is(true));
}

@Test
public void testOrganizationsClaimAsList() throws Exception {
OrganizationRepresentation orgA = createOrganization("orga", true);
Expand Down