fix: CGD-238: BPN from access_token ignore case

cpomorska · Jun 19, 2023 · f6bf0d5 · f6bf0d5
1 parent f1f6a56
commit f6bf0d5
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 4 deletions.
diff --git a/src/main/java/org/eclipse/tractusx/managedidentitywallets/controller/BaseController.java b/src/main/java/org/eclipse/tractusx/managedidentitywallets/controller/BaseController.java
@@ -28,6 +28,8 @@
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
 
 import java.security.Principal;
+import java.util.Map;
+import java.util.TreeMap;
 
 /**
  * The type Base controller.
@@ -44,8 +46,11 @@ public String getBPNFromToken(Principal principal) {
         Object principal1 = ((JwtAuthenticationToken) principal).getPrincipal();
         Jwt jwt = (Jwt) principal1;
 
-        Validate.isFalse(jwt.getClaims().containsKey(StringPool.BPN_UPPER_CASE)).launch(new ForbiddenException("Invalid token, BPN not found"));
-
-        return jwt.getClaims().get(StringPool.BPN_UPPER_CASE).toString();
+        //this will misbehave if we have more then one claims with different case
+        // ie. BPN=123456 and bpn=789456
+        Map<String, Object> claims = new TreeMap<>(String.CASE_INSENSITIVE_ORDER);
+        claims.putAll(jwt.getClaims());
+        Validate.isFalse(claims.containsKey(StringPool.BPN)).launch(new ForbiddenException("Invalid token, BPN not found"));
+        return claims.get(StringPool.BPN).toString();
     }
 }
diff --git a/src/test/java/org/eclipse/tractusx/managedidentitywallets/utils/AuthenticationUtils.java b/src/test/java/org/eclipse/tractusx/managedidentitywallets/utils/AuthenticationUtils.java
@@ -33,6 +33,7 @@
 
 import java.util.List;
 import java.util.Map;
+import java.util.Random;
 import java.util.UUID;
 
 public class AuthenticationUtils {
@@ -80,6 +81,12 @@ public static HttpHeaders getValidUserHttpHeaders() {
 
 
     private static String getJwtToken(String username, String bpn) {
+
+        List<String> list = List.of("BPN", "bpn", "bPn"); //Do not add more field here, if you do make sure you change in keycloak realm file
+        Random randomizer = new Random();
+        String attributeName = list.get(randomizer.nextInt(list.size()));
+        System.out.println("attributeName---------------------->" + attributeName);
+
         Keycloak keycloak = KeycloakBuilder.builder()
                 .serverUrl(TestContextInitializer.getAuthServerUrl())
                 .realm(StringPool.REALM)
@@ -96,7 +103,7 @@ private static String getJwtToken(String username, String bpn) {
         UserResource userResource = realmResource.users().get(userRepresentations.get(0).getId());
         userRepresentation.setEmailVerified(true);
         userRepresentation.setEnabled(true);
-        userRepresentation.setAttributes(Map.of(StringPool.BPN_UPPER_CASE, List.of(bpn)));
+        userRepresentation.setAttributes(Map.of(attributeName, List.of(bpn)));
         userResource.update(userRepresentation);
         return getJwtToken(username);
     }

diff --git a/src/test/resources/miw-test-realm.json b/src/test/resources/miw-test-realm.json
@@ -780,6 +780,38 @@
             "claim.name": "BPN"
           }
         },
+        {
+          "id": "c46e9cc6-3057-4640-a78b-e12fc3a723df",
+          "name": "bpn",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": {
+            "aggregate.attrs": "false",
+            "userinfo.token.claim": "true",
+            "multivalued": "false",
+            "user.attribute": "bpn",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "claim.name": "bpn"
+          }
+        },
+        {
+          "id": "c46e9cc6-3057-4640-a78b-e12fc3a814df",
+          "name": "bPn",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": {
+            "aggregate.attrs": "false",
+            "userinfo.token.claim": "true",
+            "multivalued": "false",
+            "user.attribute": "bPn",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "claim.name": "bPn"
+          }
+        },
         {
           "id": "1340463e-a737-4507-8ecb-b01715a9fde4",
           "name": "Client IP Address",