JanssenProject / JanssenProject/jans

Format JSON values properly in id_token / Userinfo tokens

Open
#341 1 comment 0 reactions 1 assignee Claimed by @yuriyz View on GitHub
comp-jans-auth-server effort-5 kind-enhancement priority-4 ready-for-triage
Dominant language
Java
Stars
647
Forks
173
Avg merge
1d 18h
Merged PRs (30d)
110

Description

_aliaksander-samuseu commented on Jun 13, 2018_
**A bit of context:**

Currently, if an attribute's type is text, and a JSON object is stored in it, when this attribute's value is included in JSON object of `/userinfo` response during an OIDC flow, it's re-encoded as a regular string value.

Example:
A JSON object like below

`{"salt": "macnh", "test_bool": true}`
...is changed into this:

`"{\"salt\": \"macnh\", \"test_bool\": true}"`
Even if this attribute's value is set via web UI, it's still represented as a JSON in LDAP, so apparently it's re-encoded on the fly when userinfo request is being served.

It's should be noted that it's possible to include enclosed JSON objects into the base JSON object of `userinfo` response from within dynamic scope script, so technically it shouldn't be that hard to make it properly handle JSON objects persisted in attributes in LDAP as well.

Original ticket where it was reported is [here](https://support.gluu.org/identity-management/5567/possible-to-return-userinfo-claims-as-dict-or-list/)

**Suggestion:**

Add a new attribute's type "JSON" selectable in "Type" dropdown list when it's created/modified, to handle this case more gracefully. If such type is detected when claim's value is being composed, oxAuth will verify it's a valid JSON object and will encode it correspondingly before adding to `userinfo`'s response. Should work both for cases when claims are fetched from `userinfo`, and when they are included in `id_token` (when the legacy mode is enabled)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.