Add state param for api based auth

wso2-extensions · Dec 1, 2023 · 515a525 · 515a525
1 parent 05e35bc
commit 515a525
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/.../org/wso2/carbon/identity/application/authenticator/magiclink/MagicLinkAuthenticator.java b/.../org/wso2/carbon/identity/application/authenticator/magiclink/MagicLinkAuthenticator.java
@@ -65,6 +65,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.UUID;
 import java.util.concurrent.TimeUnit;
 
 import static org.wso2.carbon.identity.application.authentication.framework.util.FrameworkConstants.RequestParams.RESTART_FLOW;
@@ -212,6 +213,15 @@ protected void initiateAuthenticationRequest(HttpServletRequest request, HttpSer
                 if (StringUtils.isNotEmpty(magicToken)) {
                     String expiryTime =
                             TimeUnit.SECONDS.toMinutes(getExpiryTime()) + " " + TimeUnit.MINUTES.name().toLowerCase();
+                    if (Boolean.parseBoolean((String) context.getProperty(IS_API_BASED))) {
+                        /* Setting a state param to the request for the client to be able to correlate the
+                        magic link coming to the app in API based authentication flow. The code is written in
+                        this manner as it is not possible to dynamically set params to the email template. */
+                        String state = UUID.randomUUID().toString();
+                        context.setProperty(MagicLinkAuthenticatorConstants.AUTHENTICATOR_NAME +
+                                MagicLinkAuthenticatorConstants.STATE_PARAM_SUFFIX, state);
+                        magicToken = magicToken + "&" + MagicLinkAuthenticatorConstants.STATE_PARAM + "=" + state;
+                    }
                     triggerEvent(user, context, magicToken, expiryTime);
                 }
             }
@@ -660,6 +670,13 @@ public Optional<AuthenticatorData> getAuthInitiationData(AuthenticationContext c
             requiredParams.add(MLT);
             authenticatorData.setRequiredParams(requiredParams);
             setAuthParams(authenticatorData);
+            Map<String, String> additionalAuthenticationParams = new HashMap<>();
+            String state = (String) context.getProperty(MagicLinkAuthenticatorConstants.AUTHENTICATOR_NAME +
+                    MagicLinkAuthenticatorConstants.STATE_PARAM_SUFFIX);
+            additionalAuthenticationParams.put(MagicLinkAuthenticatorConstants.STATE_PARAM, state);
+            AdditionalData additionalData = new AdditionalData();
+            additionalData.setAdditionalAuthenticationParams(additionalAuthenticationParams);
+            authenticatorData.setAdditionalData(additionalData);
         }
 
         return Optional.of(authenticatorData);

diff --git a/.../carbon/identity/application/authenticator/magiclink/MagicLinkAuthenticatorConstants.java b/.../carbon/identity/application/authenticator/magiclink/MagicLinkAuthenticatorConstants.java
@@ -56,6 +56,8 @@ private MagicLinkAuthenticatorConstants() {
     public static final String EXPIRYTIME = "expiry-time";
     public static final String IS_API_BASED_AUTHENTICATION_SUPPORTED = "isAPIBasedAuthenticationSupported";
     public static final String CALLBACK_URL = "callbackUrl";
+    public static final String STATE_PARAM_SUFFIX = "_state_param";
+    public static final String STATE_PARAM = "state";
 
     /**
      * Constants related to log management.