Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix issues in authentication execution flow with custom authentication extension. #22715

Closed
Thisara-Welmilla opened this issue Feb 2, 2025 · 1 comment

Comments

@Thisara-Welmilla
Copy link
Contributor

Thisara-Welmilla commented Feb 2, 2025

Description

Issue:

Need to fix followings which related to the authentication execution flow with custom authentication extension:

  1. The current DB queries which retrieve user defiend local authenticators and user defined federated authenticators are not considering IDP type. Fixes user defined authentication retrieval DB queries.
  2. UseflowID as the url param to identity the corresponding authentication flow, instead of sessionDataKey.
  3. When the basic authenticator is engaged in the authentication flow, the handleRequest method for the basic authenticator is automatically triggered at the start, setting setCurrentAuthenticator to the basic authenticator. However, when the user provides a username and password, the handleResponse method is initiated, and at line [1], setCurrentAuthenticator is reset to null. Consequently, when selecting the appropriate authenticator, the system iterates through the list of authenticators in the step and checks if currentAuthenticator is null. As a result, the first authenticator in the step always gets selected.
  4. As the UserDefinedAuthenticatorEndpointConfig is not extended Serializable, when trying load the authenticator config from the context cache, there is an error ocurred. This UserDefinedAuthenticatorEndpointConfig does not required in the authentication flow, therefore skip adding that attribute of the localAuthenticator to cache.
  5. Improve custom authentication adapter.
  6. Add unit tests for authentication adapter.
  7. Add diagnostic logs for authentication action execution.
  8. If the authenticator's claim dialect is not the OIDC dialect, it directly checks for claim mapping. However, IdPs using the local claim dialect do not have claim mappings, causing the issue. If idp.isLocalClaimDialect() returns true, the email should retrieved using the WSO2 email claim.

[1].
https://github.com/wso2/carbon-identity-framework/blob/5938f4d060ca17fcfecf53346ad0b2556bb52b0b/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/handler/request/impl/DefaultRequestCoordinator.java#L350
[2].
https://github.com/wso2/carbon-identity-framework/blob/5938f4d060ca17fcfecf53346ad0b2556bb52b0b/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/handler/step/impl/DefaultStepHandler.java#L672

Version

No response

@Thisara-Welmilla Thisara-Welmilla self-assigned this Feb 2, 2025
@Thisara-Welmilla Thisara-Welmilla moved this to In Progress in Identity Server 7.1.0 Feb 2, 2025
@Thisara-Welmilla Thisara-Welmilla added this to the 7.1.0-beta milestone Feb 2, 2025
@github-project-automation github-project-automation bot moved this from In Progress to Done in Identity Server 7.1.0 Feb 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Development

No branches or pull requests

2 participants