Mailing-List: contact issues-help@cxf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cxf.apache.org
Date: Mon, 10 Jul 2017 18:14:01 +0000 (UTC)
From: "Jan Bernhardt (JIRA)" <jira@apache.org>
To: issues@cxf.apache.org
Message-ID: <JIRA.13085874.1499676072000.209697.1499710441823@Atlassian.JIRA>
In-Reply-To: <JIRA.13085874.1499676072000@Atlassian.JIRA>
References: <JIRA.13085874.1499676072000@Atlassian.JIRA> <JIRA.13085874.1499676072527@jira-lw-us.apache.org>
Subject: [jira] [Commented] (FEDIZ-203) Support "roles" scope
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 10 Jul 2017 18:24:11 -0000


    [ https://issues.apache.org/jira/browse/FEDIZ-203?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16080785#comment-16080785 ] 

Jan Bernhardt commented on FEDIZ-203:
-------------------------------------

According to [1] scopes can and are used to map 1:many claim values. I refactored the code so that this mapping is included now in the FedizSubjectCreator.

Once my tests are done, I'll attach my patch files to this issue so that you can review my changes, before I push them to master.

The current handling of roles with the SOAP Namespace did not look convenient to me so I refactored this part also to support "roles" by default. Of course it will still be possible to use another name for this, by applying a custom mapping. I know that the standard does not provide a name specification, but I think "roles" still fits better to an OIDC/OAuth UseCase as the SOAP Namespace which is also not a real standard by the way. ;-)

[1] http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims

> Support "roles" scope
> ---------------------
>
>                 Key: FEDIZ-203
>                 URL: https://issues.apache.org/jira/browse/FEDIZ-203
>             Project: CXF-Fediz
>          Issue Type: New Feature
>          Components: OIDC
>            Reporter: Jan Bernhardt
>            Assignee: Jan Bernhardt
>             Fix For: 1.4.1
>
>
> OIDC currently only supports role claims if they are requested as "claims" but not via "scope". Goal of this jira issue is to add support for a "roles" scope.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)