Skip to content

Provide entityID support #2955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Provide entityID support #2955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bbfba7b
Fix entityID support
VivekVinushanth Oct 9, 2025
59d8a73
Merge master
VivekVinushanth Oct 14, 2025
ecf013c
fix lint
VivekVinushanth Oct 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion ...y.oauth/src/main/java/org/wso2/carbon/identity/oauth/config/OAuthServerConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,7 @@ public class OAuthServerConfiguration {
private boolean addTenantDomainToIdTokenEnabled = false;
private boolean addUserstoreDomainToIdTokenEnabled = false;
private boolean requestObjectEnabled = true;
private boolean useEntityIDAsIssuer = false;

//default token types
public static final String DEFAULT_TOKEN_TYPE = "Default";
Expand Down Expand Up @@ -1713,6 +1714,10 @@ public String getUserInfoJWTSignatureAlgorithm() {
return userInfoJWTSignatureAlgorithm;
}

public boolean getIsUseEntityIDAsIssuerEnabled() {
return useEntityIDAsIssuer;
}

/**
* Returns whether multi value support is enabled for userinfo response.
*
Expand Down Expand Up @@ -3509,7 +3514,8 @@ private void parseOAuthDeviceCodeGrantConfig(OMElement oauthElem) {
if (oauthDeviceCodeGrantElement != null && oauthDeviceCodeGrantElement
.getFirstChildWithName(getQNameWithIdentityNS(ConfigElements.DEVICE_CODE_KEY_SET)) != null) {
deviceCodeKeySet = oauthDeviceCodeGrantElement
.getFirstChildWithName(getQNameWithIdentityNS(ConfigElements.DEVICE_CODE_KEY_SET)).getText().trim();
.getFirstChildWithName(getQNameWithIdentityNS(ConfigElements.DEVICE_CODE_KEY_SET)).getText()
.trim();
}
}

Expand Down Expand Up @@ -3722,6 +3728,13 @@ private void parseOpenIDConnectConfig(OMElement oauthConfigElem) {
isJWTSignedWithSPKey = Boolean.parseBoolean(openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_SIGN_JWT_WITH_SP_KEY)).getText().trim());
}

if (openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER)) != null) {
useEntityIDAsIssuer = Boolean.parseBoolean(openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER)).getText().trim());
}
Comment on lines +3732 to +3736
Copy link
Contributor

@wso2-engineering wso2-engineering bot Oct 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 1

Suggested change
if (openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER)) != null) {
useEntityIDAsIssuer = Boolean.parseBoolean(openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER)).getText().trim());
}
if (openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER)) != null) {
useEntityIDAsIssuer = Boolean.parseBoolean(openIDConnectConfigElem.getFirstChildWithName(
getQNameWithIdentityNS(ConfigElements.OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER)).getText().trim());
log.info("UseEntityIdAsIssuer configuration set to: " + useEntityIDAsIssuer);
}


if (openIDConnectConfigElem
.getFirstChildWithName(getQNameWithIdentityNS(ConfigElements.SUPPORTED_CLAIMS)) != null) {
String supportedClaimStr = openIDConnectConfigElem
Expand Down Expand Up @@ -4404,6 +4417,7 @@ private class ConfigElements {
"ReturnOnlyAppAssociatedRolesInUserInfo";

public static final String OPENID_CONNECT_SIGN_JWT_WITH_SP_KEY = "SignJWTWithSPKey";
public static final String OPENID_CONNECT_USE_ENTITY_ID_AS_ISSUER = "UseEntityIdAsIssuer";
public static final String OPENID_CONNECT_IDTOKEN_CUSTOM_CLAIM_CALLBACK_HANDLER =
"IDTokenCustomClaimsCallBackHandler";
public static final String OPENID_CONNECT_CONVERT_ORIGINAL_CLAIMS_FROM_ASSERTIONS_TO_OIDCDIALECT =
Expand Down
15 changes: 13 additions & 2 deletions ....carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/util/OAuth2Util.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4770,8 +4770,19 @@ public static String getIdTokenIssuer(String tenantDomain, boolean isMtlsRequest
if (IdentityTenantUtil.shouldUseTenantQualifiedURLs() && StringUtils.isEmpty(PrivilegedCarbonContext.
getThreadLocalCarbonContext().getApplicationResidentOrganizationId())) {
try {
return isMtlsRequest ? OAuthURL.getOAuth2MTLSTokenEPUrl() :
ServiceURLBuilder.create().addPath(OAUTH2_TOKEN_EP_URL).build().getAbsolutePublicURL();
if (isMtlsRequest) {
return OAuthURL.getOAuth2MTLSTokenEPUrl();
}
Comment on lines +4773 to +4775
Copy link
Contributor

@wso2-engineering wso2-engineering bot Oct 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 2

Suggested change
if (isMtlsRequest) {
return OAuthURL.getOAuth2MTLSTokenEPUrl();
}
if (isMtlsRequest) {
log.debug("Using MTLS token endpoint URL for tenant: " + tenantDomain);
return OAuthURL.getOAuth2MTLSTokenEPUrl();
}


if (OAuthServerConfiguration.getInstance().getIsUseEntityIDAsIssuerEnabled()) {
return getResidentIdpEntityId(tenantDomain);
}
Comment on lines +4777 to +4779
Copy link
Contributor

@wso2-engineering wso2-engineering bot Oct 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 3

Suggested change
if (OAuthServerConfiguration.getInstance().getIsUseEntityIDAsIssuerEnabled()) {
return getResidentIdpEntityId(tenantDomain);
}
if (OAuthServerConfiguration.getInstance().getIsUseEntityIDAsIssuerEnabled()) {
log.debug("Using entity ID as issuer for tenant: " + tenantDomain);
return getResidentIdpEntityId(tenantDomain);
}


return ServiceURLBuilder.create()
.addPath(OAUTH2_TOKEN_EP_URL)
.build()
.getAbsolutePublicURL();

} catch (URLBuilderException e) {
String errorMsg = String.format("Error while building the absolute url of the context: '%s', for the" +
" tenant domain: '%s'", OAUTH2_TOKEN_EP_URL, tenantDomain);
Expand Down
Loading