JanssenProject / JanssenProject/jans
feat(jans-config-api): include required scopes in authorizatio_code token to use it access ConfigAPI from Admin-ui
@duttarnab is already working on this.
Since Aug 31, 2026.
- Dominant language
- Java
- Stars
- 648
- Forks
- 174
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
ref: https://docs.gluu.org/stable/admin/admin-ui/auth-server-interaction/#the-authorization-code-flow
Admin UI does not use the Authentication_code token to access ConfigAPI's protected endpoint. After successful authentication it:
1. Get authorization-code
2. Exchanges code <=> Authentication_code token (AT1)
3. Exchanges Authentication_code token (AT1) <=> user-info-jwt
4. Then generated client-credential token (AT2) with the scopes (included) mapped with the authenticated user's role.
We need to explore and implement the way so that Authentication_code token(AT1) can be used for accessing ConfigAPI so the use of AT2 can be eradicated.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.