Modify apple authenticator to enable federation flow in API based Authentication and Nonce validation #9

ZiyamSanthosh · 2024-06-30T16:16:22Z

This PR includes the below given changes

Enables API based authentication with federation flow for Apple authenticator. This supports both Native mode and Redirection mode.
Enable nonce validation for apple authenticator.

Related issue:

redirectUrl is missing in Apple Federated Authenticator for API based authentication wso2/product-is#20584

Merge the PR after merging the below given PR and bumping the oidc version:

Change authenticator property keys to be specific for different authenticators identity-outbound-auth-oidc#186

Sample Responses

Initial /authorize request

{
    "flowId": "44f86b73-55fd-4ec5-8571-c7f4049d3c07",
    "flowStatus": "INCOMPLETE",
    "flowType": "AUTHENTICATION",
    "nextStep": {
        "stepType": "MULTI_OPTIONS_PROMPT",
        "authenticators": [
            {
                "authenticatorId": "R29vZ2xlT0lEQ0F1dGhlbnRpY2F0b3I6R29vZ2xl",
                "authenticator": "Google",
                "idp": "Google",
                "metadata": {
                    "i18nKey": "authenticator.google"
                }
            },
            {
                "authenticatorId": "QXBwbGVPSURDQXV0aGVudGljYXRvcjpBcHBsZQ",
                "authenticator": "Apple",
                "idp": "Apple",
                "metadata": {
                    "i18nKey": "authenticator.apple"
                }
            }
        ]
    },
    "links": [
        {
            "name": "authentication",
            "href": "https://wso2is.com:9443/oauth2/authn",
            "method": "POST"
        }
    ]
}

/authn request (Native mode)

{
    "flowId": "44f86b73-55fd-4ec5-8571-c7f4049d3c07",
    "flowStatus": "INCOMPLETE",
    "flowType": "AUTHENTICATION",
    "nextStep": {
        "stepType": "AUTHENTICATOR_PROMPT",
        "authenticators": [
            {
                "authenticatorId": "QXBwbGVPSURDQXV0aGVudGljYXRvcjpBcHBsZQ",
                "authenticator": "Apple",
                "idp": "Apple",
                "metadata": {
                    "i18nKey": "authenticator.apple",
                    "promptType": "INTERNAL_PROMPT",
                    "additionalData": {
                        "clientId": "com.asgupgrade.stage",
                        "scope": "email name"
                    }
                },
                "requiredParams": [
                    "accessToken",
                    "idToken"
                ]
            }
        ]
    },
    "links": [
        {
            "name": "authentication",
            "href": "https://wso2is.com:9443/oauth2/authn",
            "method": "POST"
        }
    ]
}

/authn request (Redirection mode)

{
    "flowId": "44f86b73-55fd-4ec5-8571-c7f4049d3c07",
    "flowStatus": "INCOMPLETE",
    "flowType": "AUTHENTICATION",
    "nextStep": {
        "stepType": "AUTHENTICATOR_PROMPT",
        "authenticators": [
            {
                "authenticatorId": "QXBwbGVPSURDQXV0aGVudGljYXRvcjpBcHBsZQ",
                "authenticator": "Apple",
                "idp": "Apple",
                "metadata": {
                    "i18nKey": "authenticator.apple",
                    "promptType": "REDIRECTION_PROMPT",
                    "additionalData": {
                        "state": "43fa600f-0ad3-4170-80e8-d8e615d59e09,OIDC",
                        "redirectUrl": "https://appleid.apple.com/auth/authorize?response_type=code&state=43fa600f-0ad3-4170-80e8-d8e615d59e09%2COIDC&redirect_uri=https%3A%2F%2Fgoogle.com&client_id=com.asgupgrade.stage&scope=email%20name&response_mode=form_post"
                    }
                },
                "requiredParams": [
                    "code",
                    "state"
                ]
            }
        ]
    },
    "links": [
        {
            "name": "authentication",
            "href": "https://wso2is.com:9443/oauth2/authn",
            "method": "POST"
        }
    ]
}

Related links:
[1] https://developer.apple.com/documentation/authenticationservices/asauthorizationopenidrequest/nonce

Sample JWT Payload from apple IDP

{
  "iss": "https://appleid.apple.com",
  "aud": "com.asgupgrade.stage",
  "exp": 1720100111,
  "iat": 1720013711,
  "sub": "001094.77fd79fb64a1413398438254b1a28e64.0535",
  "nonce": "f9945071-859e-4d2a-a6e4-5b435f16d109",
  "at_hash": "LfD82O14Te81Z_jqY6fAuQ",
  "email": "ziyam@wso2.com",
  "email_verified": true,
  "auth_time": 1720013689,
  "nonce_supported": true
}

…hentication

CLAassistant · 2024-06-30T16:16:28Z

All committers have signed the CLA.

jenkins-is-staging · 2024-06-30T19:36:43Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/9734468257

jenkins-is-staging · 2024-06-30T21:15:14Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/9734468257
Status: success

jenkins-is-staging

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/9734468257

…text properties

…ator

jenkins-is-staging · 2024-07-01T11:35:35Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/9743477163

jenkins-is-staging · 2024-07-01T13:18:05Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/9743477163
Status: success

jenkins-is-staging

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/9743477163

Thumimku

LGTM

pamodaaw · 2024-07-03T03:38:36Z

...c/main/java/org/wso2/carbon/identity/application/authenticator/apple/AppleAuthenticator.java

@@ -145,8 +151,13 @@ protected void initiateAuthenticationRequest(HttpServletRequest request, HttpSer
                String clientId = authenticatorProperties.get(OIDCAuthenticatorConstants.CLIENT_ID);
                String authorizationEP = getAuthorizationServerEndpoint(authenticatorProperties);
                String callbackUrl = getCallbackUrl(authenticatorProperties);
-                String state = getStateParameter(context, authenticatorProperties);
+                if (Boolean.parseBoolean((String) context.getProperty(IS_API_BASED))) {
+                    callbackUrl = resolveCallBackURLForAPIBasedAuthFlow(context);


can't we have line 153 as the else block of this if?

Or we can have getCallbackUrl method in this class and define this logic there

Addressed in 9f2bc6f

pamodaaw · 2024-07-03T03:46:39Z

...c/main/java/org/wso2/carbon/identity/application/authenticator/apple/AppleAuthenticator.java

@@ -145,8 +151,13 @@ protected void initiateAuthenticationRequest(HttpServletRequest request, HttpSer
                String clientId = authenticatorProperties.get(OIDCAuthenticatorConstants.CLIENT_ID);
                String authorizationEP = getAuthorizationServerEndpoint(authenticatorProperties);
                String callbackUrl = getCallbackUrl(authenticatorProperties);
-                String state = getStateParameter(context, authenticatorProperties);
+                if (Boolean.parseBoolean((String) context.getProperty(IS_API_BASED))) {


when this IS_API_BASED property is set in the context?

This is being set at the framework[1].

[1] https://github.com/wso2/carbon-identity-framework/blob/3782fee47c7c612d37f955c12c5f70317c020e4b/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/handler/request/impl/DefaultRequestCoordinator.java#L791-L794

So why can't we use the same constant defined in the framework?

This concern was addressed with 9f2bc6f

jenkins-is-staging · 2024-07-03T06:06:08Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/9772703024

jenkins-is-staging · 2024-07-03T06:49:49Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/9773189192

jenkins-is-staging · 2024-07-03T06:49:54Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/9772703024
Status: cancelled

janakamarasena · 2024-07-03T07:56:35Z

...c/main/java/org/wso2/carbon/identity/application/authenticator/apple/AppleAuthenticator.java

+    protected String getScope(Map<String, String> authenticatorProperties) {
+
+        String scopes = authenticatorProperties.get(IdentityApplicationConstants.Authenticator.OIDC.SCOPES);
+        return scopes.replace(",", " ").replace("+", " ");


Lets add a null check here

also lets take the separators to constants

This was addressed in both 1a9f83d and 84cbc2f

jenkins-is-staging · 2024-07-03T08:29:31Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/9773189192
Status: success

jenkins-is-staging

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/9773189192

pamodaaw · 2024-07-03T08:30:49Z

...c/main/java/org/wso2/carbon/identity/application/authenticator/apple/AppleAuthenticator.java

+     * @param context Authentication context.
+     * @return Callback URL.
+     */
+    private String getCallBackURL(AuthenticationContext context, Map<String, String> authenticatorProperties) {


https://github.com/wso2-extensions/identity-outbound-auth-oidc/blob/master/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java#L310

Can't we inherit this method from OpenIDConnectAuthenticator

This was addressed in 1a9f83d

jenkins-is-staging · 2024-07-04T06:11:40Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/9789383875

jenkins-is-staging · 2024-07-04T08:07:16Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/9789383875
Status: success

jenkins-is-staging

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/9789383875

Modify apple authenticator to enable federation flow in API based Aut…

e4384ca

…hentication

jenkins-is-staging approved these changes Jun 30, 2024

View reviewed changes

ZiyamSanthosh added 3 commits July 1, 2024 16:55

Replace apple authenticator name with OIDC authenticator name for con…

8c8dd0b

…text properties

Add unit test cases for API based authentication with Apple authentic…

de0cdf9

…ator

Fix unit test failures

64d0502

Fix to execute dependent test in order

8df037a

jenkins-is-staging approved these changes Jul 1, 2024

View reviewed changes

Thumimku previously approved these changes Jul 2, 2024

View reviewed changes

pamodaaw reviewed Jul 3, 2024

View reviewed changes

Addressing review comments

9f2bc6f

ZiyamSanthosh dismissed Thumimku’s stale review via 9f2bc6f July 3, 2024 06:02

Fix keys to store properties in context

c025b24

janakamarasena reviewed Jul 3, 2024

View reviewed changes

jenkins-is-staging approved these changes Jul 3, 2024

View reviewed changes

pamodaaw reviewed Jul 3, 2024

View reviewed changes

ZiyamSanthosh added 2 commits July 4, 2024 09:26

Enable nonce validation for apple authenticator

1a9f83d

Introduce constants for scope separators

84cbc2f

ZiyamSanthosh changed the title ~~Modify apple authenticator to enable federation flow in API based Authentication~~ Modify apple authenticator to enable federation flow in API based Authentication and Nonce validation Jul 4, 2024

pamodaaw previously approved these changes Jul 4, 2024

View reviewed changes

Bump oidc version

d235a14

ZiyamSanthosh dismissed pamodaaw’s stale review via d235a14 July 4, 2024 06:05

jenkins-is-staging approved these changes Jul 4, 2024

View reviewed changes

shanggeeth approved these changes Jul 4, 2024

View reviewed changes

ZiyamSanthosh merged commit 9fa9386 into wso2-extensions:main Jul 4, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Modify apple authenticator to enable federation flow in API based Authentication and Nonce validation #9

Modify apple authenticator to enable federation flow in API based Authentication and Nonce validation #9

ZiyamSanthosh commented Jun 30, 2024 •

edited

Loading

CLAassistant commented Jun 30, 2024 •

edited

Loading

jenkins-is-staging commented Jun 30, 2024

jenkins-is-staging commented Jun 30, 2024

jenkins-is-staging left a comment

jenkins-is-staging commented Jul 1, 2024

jenkins-is-staging commented Jul 1, 2024

jenkins-is-staging left a comment

Thumimku left a comment

pamodaaw Jul 3, 2024

pamodaaw Jul 3, 2024

ZiyamSanthosh Jul 3, 2024

pamodaaw Jul 3, 2024

ZiyamSanthosh Jul 3, 2024

pamodaaw Jul 3, 2024

ZiyamSanthosh Jul 3, 2024

jenkins-is-staging commented Jul 3, 2024

jenkins-is-staging commented Jul 3, 2024

jenkins-is-staging commented Jul 3, 2024

janakamarasena Jul 3, 2024

janakamarasena Jul 3, 2024

ZiyamSanthosh Jul 4, 2024

jenkins-is-staging commented Jul 3, 2024

jenkins-is-staging left a comment

pamodaaw Jul 3, 2024

ZiyamSanthosh Jul 4, 2024

jenkins-is-staging commented Jul 4, 2024

jenkins-is-staging commented Jul 4, 2024

jenkins-is-staging left a comment

Modify apple authenticator to enable federation flow in API based Authentication and Nonce validation #9

Modify apple authenticator to enable federation flow in API based Authentication and Nonce validation #9

Conversation

ZiyamSanthosh commented Jun 30, 2024 • edited Loading

CLAassistant commented Jun 30, 2024 • edited Loading

jenkins-is-staging commented Jun 30, 2024

jenkins-is-staging commented Jun 30, 2024

jenkins-is-staging left a comment

Choose a reason for hiding this comment

jenkins-is-staging commented Jul 1, 2024

jenkins-is-staging commented Jul 1, 2024

jenkins-is-staging left a comment

Choose a reason for hiding this comment

Thumimku left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenkins-is-staging commented Jul 3, 2024

jenkins-is-staging commented Jul 3, 2024

jenkins-is-staging commented Jul 3, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenkins-is-staging commented Jul 3, 2024

jenkins-is-staging left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenkins-is-staging commented Jul 4, 2024

jenkins-is-staging commented Jul 4, 2024

jenkins-is-staging left a comment

Choose a reason for hiding this comment

ZiyamSanthosh commented Jun 30, 2024 •

edited

Loading

CLAassistant commented Jun 30, 2024 •

edited

Loading