feat(oauth2): populate groups claim in client_credentials tokens (#4691)

Signed-off-by: Carles Arnal <carlesarnal92@gmail.com>
Signed-off-by: Carles Arnal <carnalca@redhat.com>

Author: carlesarnal

server/handlers.go

@@ -1919,12 +1919,16 @@ func (s *Server) handleClientCredentialsGrant(w http.ResponseWriter, r *http.Req
 		UserID: client.ID,
 	}
 
-	// Only populate Username/PreferredUsername when the profile scope is requested.
+	// Populate optional claims based on requested scopes.
 	for _, scope := range scopes {
-		if scope == scopeProfile {
+		switch scope {
+		case scopeProfile:
 			claims.Username = client.Name
 			claims.PreferredUsername = client.Name
-			break
+		case scopeGroups:
+			if client.ClientCredentialsClaims != nil {
+				claims.Groups = client.ClientCredentialsClaims.Groups
+			}
 		}
 	}
 

server/handlers_test.go

@@ -1118,14 +1118,16 @@ func TestHandlePasswordLoginWithSkipApproval(t *testing.T) {
 
 func TestHandleClientCredentials(t *testing.T) {
 	tests := []struct {
-		name          string
-		clientID      string
-		clientSecret  string
-		scopes        string
-		wantCode      int
-		wantAccessTok bool
-		wantIDToken   bool
-		wantUsername  string
+		name                    string
+		clientID                string
+		clientSecret            string
+		clientCredentialsClaims *storage.ClientCredentialsClaims
+		scopes                  string
+		wantCode                int
+		wantAccessTok           bool
+		wantIDToken             bool
+		wantUsername            string
+		wantGroups              []string
 	}{
 		{
 			name:          "Basic grant, no scopes",
@@ -1165,6 +1167,28 @@ func TestHandleClientCredentials(t *testing.T) {
 			wantIDToken:   true,
 			wantUsername:  "Test Client",
 		},
+		{
+			name:         "With groups scope and clientCredentialsClaims groups populated",
+			clientID:     "test",
+			clientSecret: "barfoo",
+			clientCredentialsClaims: &storage.ClientCredentialsClaims{
+				Groups: []string{"admin-group", "dev-group"},
+			},
+			scopes:        "openid groups",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+			wantGroups:    []string{"admin-group", "dev-group"},
+		},
+		{
+			name:          "With groups scope but no clientCredentialsClaims configured",
+			clientID:      "test",
+			clientSecret:  "barfoo",
+			scopes:        "openid groups",
+			wantCode:      200,
+			wantAccessTok: true,
+			wantIDToken:   true,
+		},
 		{
 			name:         "Invalid client secret",
 			clientID:     "test",
@@ -1205,10 +1229,11 @@ func TestHandleClientCredentials(t *testing.T) {
 
 			// Create a confidential client for testing.
 			err := s.storage.CreateClient(ctx, storage.Client{
-				ID:           "test",
-				Secret:       "barfoo",
-				RedirectURIs: []string{"https://example.com/callback"},
-				Name:         "Test Client",
+				ID:                      "test",
+				Secret:                  "barfoo",
+				RedirectURIs:            []string{"https://example.com/callback"},
+				Name:                    "Test Client",
+				ClientCredentialsClaims: tc.clientCredentialsClaims,
 			})
 			require.NoError(t, err)
 
@@ -1264,8 +1289,9 @@ func TestHandleClientCredentials(t *testing.T) {
 					require.Equal(t, tc.clientID, sub.UserId)
 
 					var claims struct {
-						Name              string `json:"name"`
-						PreferredUsername string `json:"preferred_username"`
+						Name              string   `json:"name"`
+						PreferredUsername string   `json:"preferred_username"`
+						Groups            []string `json:"groups"`
 					}
 					require.NoError(t, idToken.Claims(&claims))
 
@@ -1276,6 +1302,12 @@ func TestHandleClientCredentials(t *testing.T) {
 						require.Empty(t, claims.Name)
 						require.Empty(t, claims.PreferredUsername)
 					}
+
+					if tc.wantGroups != nil {
+						require.Equal(t, tc.wantGroups, claims.Groups)
+					} else {
+						require.Empty(t, claims.Groups)
+					}
 				} else {
 					require.Empty(t, resp.IDToken)
 				}

storage/ent/client/client.go

@@ -8,7 +8,7 @@ import (
 
 // CreateClient saves provided oauth2 client settings into the database.
 func (d *Database) CreateClient(ctx context.Context, client storage.Client) error {
-	_, err := d.client.OAuth2Client.Create().
+	create := d.client.OAuth2Client.Create().
 		SetID(client.ID).
 		SetName(client.Name).
 		SetSecret(client.Secret).
@@ -19,8 +19,11 @@ func (d *Database) CreateClient(ctx context.Context, client storage.Client) erro
 		SetAllowedConnectors(client.AllowedConnectors).
 		SetMfaChain(client.MFAChain).
 		SetPostLogoutRedirectUris(client.PostLogoutRedirectURIs).
-		SetSSOSharedWith(client.SSOSharedWith).
-		Save(ctx)
+		SetSSOSharedWith(client.SSOSharedWith)
+	if client.ClientCredentialsClaims != nil {
+		create = create.SetClientCredentialsClaims(client.ClientCredentialsClaims)
+	}
+	_, err := create.Save(ctx)
 	if err != nil {
 		return convertDBError("create oauth2 client: %w", err)
 	}
@@ -76,7 +79,7 @@ func (d *Database) UpdateClient(ctx context.Context, id string, updater func(old
 		return rollback(tx, "update client updating: %w", err)
 	}
 
-	_, err = tx.OAuth2Client.UpdateOneID(newClient.ID).
+	update := tx.OAuth2Client.UpdateOneID(newClient.ID).
 		SetName(newClient.Name).
 		SetSecret(newClient.Secret).
 		SetPublic(newClient.Public).
@@ -86,8 +89,13 @@ func (d *Database) UpdateClient(ctx context.Context, id string, updater func(old
 		SetAllowedConnectors(newClient.AllowedConnectors).
 		SetMfaChain(newClient.MFAChain).
 		SetPostLogoutRedirectUris(newClient.PostLogoutRedirectURIs).
-		SetSSOSharedWith(newClient.SSOSharedWith).
-		Save(ctx)
+		SetSSOSharedWith(newClient.SSOSharedWith)
+	if newClient.ClientCredentialsClaims != nil {
+		update = update.SetClientCredentialsClaims(newClient.ClientCredentialsClaims)
+	} else {
+		update = update.ClearClientCredentialsClaims()
+	}
+	_, err = update.Save(ctx)
 	if err != nil {
 		return rollback(tx, "update client uploading: %w", err)
 	}

storage/ent/client/types.go

@@ -87,17 +87,18 @@ func toStorageAuthCode(a *db.AuthCode) storage.AuthCode {
 
 func toStorageClient(c *db.OAuth2Client) storage.Client {
 	return storage.Client{
-		ID:                     c.ID,
-		Secret:                 c.Secret,
-		RedirectURIs:           c.RedirectUris,
-		TrustedPeers:           c.TrustedPeers,
-		Public:                 c.Public,
-		Name:                   c.Name,
-		LogoURL:                c.LogoURL,
-		AllowedConnectors:      c.AllowedConnectors,
-		MFAChain:               c.MfaChain,
-		PostLogoutRedirectURIs: c.PostLogoutRedirectUris,
-		SSOSharedWith:          c.SSOSharedWith,
+		ID:                      c.ID,
+		Secret:                  c.Secret,
+		RedirectURIs:            c.RedirectUris,
+		TrustedPeers:            c.TrustedPeers,
+		Public:                  c.Public,
+		Name:                    c.Name,
+		LogoURL:                 c.LogoURL,
+		AllowedConnectors:       c.AllowedConnectors,
+		MFAChain:                c.MfaChain,
+		PostLogoutRedirectURIs:  c.PostLogoutRedirectUris,
+		SSOSharedWith:           c.SSOSharedWith,
+		ClientCredentialsClaims: c.ClientCredentialsClaims,
 	}
 }