Skip to content

feat: Return token claims on OIDC validation #4641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pavel-jares-bcm wants to merge 7 commits into
base: v3.x.x
Choose a base branch
from
Open

feat: Return token claims on OIDC validation #4641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b7712ad
return claims on OIDC validation
pavel-jares-bcm May 25, 2026
8b127a2
Merge branch 'v3.x.x' into reboot/oidc-validation-with-claims
pavel-jares-bcm May 27, 2026
f5a7dd3
fixes
pavel-jares-bcm May 27, 2026
ab22c54
Merge branch 'v3.x.x' into reboot/oidc-validation-with-claims
pavel-jares-bcm May 28, 2026
9f463dd
Merge branch 'v3.x.x' into reboot/oidc-validation-with-claims
pavel-jares-bcm Jun 1, 2026
813fc07
Merge branch 'v3.x.x' into reboot/oidc-validation-with-claims
pavel-jares-bcm Jun 1, 2026
aad1e18
code review
pavel-jares-bcm Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...-tests/src/test/java/org/zowe/apiml/integration/authentication/oauth2/OidcOauth2Test.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ void thenValidateReturns200(String validToken) {
.body(requestBody)
.when()
.post(VALIDATE_ENDPOINT)
.then().statusCode(HttpStatus.SC_NO_CONTENT);
.then().statusCode(HttpStatus.SC_OK);
}

@Nested
Expand Down
3 changes: 3 additions & 0 deletions zaas-client/src/main/java/org/zowe/apiml/zaasclient/oidc/ZaasOidcValidationResult.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@
import lombok.AllArgsConstructor;
import lombok.Data;

import java.util.Map;

/**
*
*/
Expand All @@ -21,5 +23,6 @@
public class ZaasOidcValidationResult {

private boolean isValid = false;
private Map<String, Object> claims;

}
12 changes: 10 additions & 2 deletions zaas-client/src/main/java/org/zowe/apiml/zaasclient/service/internal/ZaasJwtService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
import java.net.HttpCookie;
import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.function.Predicate;
import java.util.stream.Collectors;
Expand Down Expand Up @@ -166,12 +167,19 @@ private ClassicHttpRequest validateOidcToken(String oidcToken) throws JsonProces

private ZaasOidcValidationResult extractZaasOidcValidate(SimpleHttpResponse response) throws IOException, ZaasClientException {
int statusCode = response.getCode();

if (statusCode == 200) {
var body = response.getStringBody();
var claims = objectMapper.readValue(body, Map.class);
return new ZaasOidcValidationResult(true, claims);
}

if (statusCode == 204) {
Copy link
Copy Markdown
Contributor

@taban03 taban03 Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does it make sense to keep the 204 case?

Copy link
Copy Markdown
Contributor Author

@pavel-jares-bcm pavel-jares-bcm Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, ZAAS client should be able communicated with both old and new version of APIML. It is independent of APIML.

return new ZaasOidcValidationResult(true);
return new ZaasOidcValidationResult(true, null);
}

if (statusCode == 401) {
return new ZaasOidcValidationResult(false);
return new ZaasOidcValidationResult(false, null);
} else {
throw new ZaasClientException(ZaasClientErrorCodes.GENERIC_EXCEPTION, response.getStringBody());
}
Expand Down
7 changes: 4 additions & 3 deletions zaas-client/src/main/java/org/zowe/apiml/zaasclient/util/SimpleHttpResponse.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import org.apache.hc.core5.http.io.entity.EntityUtils;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.List;
import java.util.Map;

Expand All @@ -44,15 +45,15 @@ public class SimpleHttpResponse {
private final Map<String, List<Header>> headers;

public SimpleHttpResponse(int code, byte[] byteBody) {
this(code, byteBody, null, Map.of());
this(code, byteBody, new String(byteBody), Map.of());
}

public SimpleHttpResponse(int code, String stringBody) {
this(code, null, stringBody, Map.of());
this(code, stringBody == null ? null : stringBody.getBytes(StandardCharsets.UTF_8), stringBody, Map.of());
}

public SimpleHttpResponse(int code, String stringBody, Map<String, List<Header>> headers) {
this(code, null, stringBody, headers);
this(code, stringBody == null ? null : stringBody.getBytes(StandardCharsets.UTF_8), stringBody, headers);
}

public SimpleHttpResponse(int code) {
Expand Down
9 changes: 3 additions & 6 deletions zaas-client/src/test/java/org/zowe/apiml/zaasclient/service/internal/ZaasClientTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,7 @@
import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.Mockito.doAnswer;
import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.when;
import static org.mockito.Mockito.*;
import static org.mockserver.model.HttpRequest.request;
import static org.mockserver.model.HttpResponse.response;
import static org.zowe.apiml.zaasclient.exception.ZaasClientErrorCodes.*;
Expand Down Expand Up @@ -234,7 +231,7 @@ void createConfigProperties() {
@Test
void givenValidOidcToken_whenValidate_thenSuccess() throws ZaasClientException {
var token = "validOidcToken";
var successResult = new ZaasOidcValidationResult(true);
var successResult = new ZaasOidcValidationResult(true, null);
when(tokens.validateOidc(token)).thenReturn(successResult);
assertSame(successResult, underTest.validateOidc(token));
}
Expand All @@ -252,7 +249,7 @@ void givenValidOidc_whenValidateException_thenRethrown() throws ZaasClientExcept
@Test
void givenInvalidOidc_whenValidate_thenFalse() throws ZaasClientException {
var token = "invalidOidc";
var failResult = new ZaasOidcValidationResult(false);
var failResult = new ZaasOidcValidationResult(false, null);
when(tokens.validateOidc(token)).thenReturn(failResult);
assertSame(failResult, underTest.validateOidc(token));
}
Expand Down
32 changes: 22 additions & 10 deletions zaas-client/src/test/java/org/zowe/apiml/zaasclient/service/internal/ZaasJwtServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,16 +38,9 @@

import java.io.IOException;

import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import static org.mockito.Mockito.*;
import static org.zowe.apiml.zaasclient.exception.ZaasClientErrorCodes.GENERIC_EXCEPTION;
import static org.zowe.apiml.zaasclient.exception.ZaasClientErrorCodes.TOKEN_NOT_PROVIDED;

Expand Down Expand Up @@ -226,11 +219,30 @@ void givenEmptyOidcToken_whenValidate_thenException() {
}

@Test
void givenValidToken_whenValidate_thenSuccess() throws ZaasClientException {
void givenValidToken_whenValidateBefore3_6_0_thenSuccess() throws ZaasClientException {
var token = "validOidcToken";
mockHttpClientResponse(204);
var validationResult = zaasJwtService.validateOidc(token);
assertTrue(validationResult.isValid());
assertNull(validationResult.getClaims());
}

@Test
void givenValidToken_whenValidateOn3_6_0_orLaterVersion_thenSuccess() throws ZaasClientException {
var token = "validOidcToken";
mockHttpClientResponse(200, """
{
"sub": "user",
"anotherClaim": "x",
"exp": 5
}
""");
var validationResult = zaasJwtService.validateOidc(token);
assertTrue(validationResult.isValid());
assertNotNull(validationResult.getClaims());
assertEquals("user", validationResult.getClaims().get("sub"));
assertEquals("x", validationResult.getClaims().get("anotherClaim"));
assertEquals(5, validationResult.getClaims().get("exp"));
}

@Test
Expand Down
23 changes: 8 additions & 15 deletions zaas-service/src/main/java/org/zowe/apiml/zaas/controllers/AuthController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,13 @@
import org.springframework.lang.Nullable;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.DeleteMapping;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.bind.annotation.*;
import org.zowe.apiml.message.api.ApiMessageView;
import org.zowe.apiml.message.core.MessageService;
import org.zowe.apiml.security.common.token.AccessTokenProvider;
import org.zowe.apiml.security.common.token.OIDCProvider;
import org.zowe.apiml.security.common.token.TokenNotValidException;
import org.zowe.apiml.security.common.util.JwtUtils;
import org.zowe.apiml.zaas.security.service.AuthenticationService;
import org.zowe.apiml.zaas.security.service.JwtSecurity;
import org.zowe.apiml.zaas.security.service.token.OIDCTokenProvider;
Expand All @@ -66,9 +60,7 @@
import java.util.List;
import java.util.Map;

import static org.apache.http.HttpStatus.SC_NO_CONTENT;
import static org.apache.http.HttpStatus.SC_OK;
import static org.apache.http.HttpStatus.SC_SERVICE_UNAVAILABLE;
import static org.apache.http.HttpStatus.*;

/**
* Controller offer method to control security. It can contain method for user and also method for calling services
Expand Down Expand Up @@ -464,7 +456,7 @@ private List<JsonWebKey> getCurrentKey() {
return currentKey.getJsonWebKeys();
}

@PostMapping(path = OIDC_TOKEN_VALIDATE)
@PostMapping(path = OIDC_TOKEN_VALIDATE, produces = MediaType.APPLICATION_JSON_VALUE)
@Operation(summary = "Validate OIDC token",
tags = {"OIDC"},
operationId = "validateOIDCToken",
Expand All @@ -481,13 +473,14 @@ private List<JsonWebKey> getCurrentKey() {
@ApiResponse(responseCode = "204", description = "Valid token"),
@ApiResponse(responseCode = "401", description = "Invalid token or OIDC provider is not defined")
})
public ResponseEntity<Void> validateOIDCToken(@RequestBody ValidateRequestModel validateRequestModel) {
public ResponseEntity<Object> validateOIDCToken(@RequestBody ValidateRequestModel validateRequestModel) {
log.debug("Validating OIDC token using provider {}", oidcProvider);
String token = validateRequestModel.getToken();
if (oidcProvider != null && oidcProvider.isValid(token)) {
return new ResponseEntity<>(HttpStatus.NO_CONTENT);
return new ResponseEntity<>(JwtUtils.getJwtClaims(token).getClaims(), HttpStatus.OK);
}
return new ResponseEntity<>(HttpStatus.UNAUTHORIZED);
final ApiMessageView message = messageService.createMessage("org.zowe.apiml.common.unauthorized").mapToView();
return new ResponseEntity<>(message, HttpStatus.UNAUTHORIZED);
}

/**
Expand Down
42 changes: 20 additions & 22 deletions zaas-service/src/test/java/org/zowe/apiml/zaas/controllers/AuthControllerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,25 +50,12 @@
import java.util.List;
import java.util.Optional;

import static org.apache.http.HttpStatus.SC_BAD_REQUEST;
import static org.apache.http.HttpStatus.SC_INTERNAL_SERVER_ERROR;
import static org.apache.http.HttpStatus.SC_NOT_FOUND;
import static org.apache.http.HttpStatus.SC_NO_CONTENT;
import static org.apache.http.HttpStatus.SC_OK;
import static org.apache.http.HttpStatus.SC_SERVICE_UNAVAILABLE;
import static org.apache.http.HttpStatus.SC_UNAUTHORIZED;
import static org.apache.http.HttpStatus.*;
import static org.hamcrest.CoreMatchers.is;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import static org.mockito.Mockito.*;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;

@ExtendWith(SpringExtension.class)
class AuthControllerTest {
Expand Down Expand Up @@ -416,28 +403,39 @@ void thenRemoveRulesAndTokens() throws Exception {
@Nested
class GivenValidateOIDCTokenRequest {

private static final String TOKEN = "token";

@Nested
class WhenValidateToken {

private static final String TOKEN = "ewogICJ0eXAiOiAiSldUIiwKICAibm9uY2UiOiAiYVZhbHVlVG9CZVZlcmlmaWVkIiwKICAiYWxnIjogIlJTMjU2IiwKICAia2lkIjogIlNlQ1JldEtleSIKfQ.ewogICJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wMDAwLWMwMDAtMDAwMDAwMDAwMDAwIiwKICAiaXNzIjogImh0dHBzOi8vb2lkYy5wcm92aWRlci5vcmcvYXBwIiwKICAiaWF0IjogMTcyMjUxNDEyOSwKICAibmJmIjogMTcyMjUxNDEyOSwKICAiZXhwIjogODcyMjUxODEyNSwKICAic3ViIjogIm9pZGMudXNlcm5hbWUiCn0.c29tZVNpZ25lZEhhc2hDb2Rl";

private String getBody() throws JSONException {
return new JSONObject()
.put("token", TOKEN)
.toString();
}

@Test
void validateOIDCToken() throws Exception {
when(oidcProvider.isValid(TOKEN)).thenReturn(true);
mockMvc.perform(post("/zaas/api/v1/auth/oidc-token/validate")
.contentType(MediaType.APPLICATION_JSON)
.content(body.toString()))
.andExpect(status().is(SC_NO_CONTENT));
.content(getBody()))
.andExpect(status().is(SC_OK))
.andExpect(jsonPath("sub", is("oidc.username")))
.andExpect(jsonPath("iss", is("https://oidc.provider.org/app")));
}

@Test
void return401() throws Exception {
when(oidcProvider.isValid(TOKEN)).thenReturn(false);
mockMvc.perform(post("/zaas/api/v1/auth/oidc-token/validate")
.contentType(MediaType.APPLICATION_JSON)
.content(body.toString()))
.content(getBody()))
.andExpect(status().is(SC_UNAUTHORIZED));
}

}

}

@Nested
Expand Down
Loading