JanssenProject / JanssenProject/jans
Format JSON values properly in id_token / Userinfo tokens
- Dominant language
- Java
- Stars
- 647
- Forks
- 173
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
_aliaksander-samuseu commented on Jun 13, 2018_
**A bit of context:**
Currently, if an attribute's type is text, and a JSON object is stored in it, when this attribute's value is included in JSON object of `/userinfo` response during an OIDC flow, it's re-encoded as a regular string value.
Example:
A JSON object like below
`{"salt": "macnh", "test_bool": true}`
...is changed into this:
`"{\"salt\": \"macnh\", \"test_bool\": true}"`
Even if this attribute's value is set via web UI, it's still represented as a JSON in LDAP, so apparently it's re-encoded on the fly when userinfo request is being served.
It's should be noted that it's possible to include enclosed JSON objects into the base JSON object of `userinfo` response from within dynamic scope script, so technically it shouldn't be that hard to make it properly handle JSON objects persisted in attributes in LDAP as well.
Original ticket where it was reported is [here](https://support.gluu.org/identity-management/5567/possible-to-return-userinfo-claims-as-dict-or-list/)
**Suggestion:**
Add a new attribute's type "JSON" selectable in "Type" dropdown list when it's created/modified, to handle this case more gracefully. If such type is detected when claim's value is being composed, oxAuth will verify it's a valid JSON object and will encode it correspondingly before adding to `userinfo`'s response. Should work both for cases when claims are fetched from `userinfo`, and when they are included in `id_token` (when the legacy mode is enabled)
Contributor guide
Assessment
This issue has not been assessed yet.