Add DCR configurations #4977

SachiniSiriwardene · 2023-10-07T13:25:05Z

Proposed changes in this pull request

[List all changes you want to add here. If you fixed an issue, please
add a reference to that issue as well.]

When should this PR be merged

[Please describe any preconditions that need to be addressed before we
can merge this pull request.]

Follow up actions

[List any possible follow-up actions here; for instance, testing data
migrations, software that we need to install on staging and production
environments.]

Checklist (for reviewing)

General

Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
Is the PR labeled correctly?

Functionality

Are all requirements met? Compare implemented functionality with the requirements specification.
Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
Are all UI and API inputs run through forms or serializers?
Are all external inputs validated and sanitized appropriately?
Does all branching logic have a default case?
Does this solution handle outliers and edge cases gracefully?
Are all external communications secured and restricted to SSL?

Documentation

Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

janakamarasena · 2023-10-10T07:08:12Z

features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2

+            <SoftwareStatementJWKS></SoftwareStatementJWKS>
+            {% endif %}
+            {% if oauth.dcr.enable_fapi_validation%}
+            <EnableFAPIValidation>{{oauth.dcr.enable_fapi_validation}}</EnableFAPIValidation>


Shall we rename this to something like. EnableFAPIEnforcement

janakamarasena · 2023-10-10T07:08:21Z

features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2

@@ -975,6 +978,12 @@
        -->
        <DCRM>
            <ApplicationRolePermissionRequiredToView>{{oauth.dcrm.application_role_permission_required_to_view}}</ApplicationRolePermissionRequiredToView>
+            {% if oauth.dcr.ssa_jkws%}
+            <SoftwareStatementJWKS></SoftwareStatementJWKS>


missing templating

janakamarasena · 2023-10-10T07:09:05Z

features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2

@@ -975,6 +978,12 @@
        -->
        <DCRM>
            <ApplicationRolePermissionRequiredToView>{{oauth.dcrm.application_role_permission_required_to_view}}</ApplicationRolePermissionRequiredToView>
+            {% if oauth.dcr.ssa_jkws%}


Suggested change

{% if oauth.dcr.ssa_jkws%}

{% if oauth.dcr.ssa_jkws is defined %}

…ework into master_DCRConf � Conflicts: � features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2 � features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json

janakamarasena · 2023-10-11T16:25:59Z

features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2

+            <SoftwareStatementJWKS>{{oauth.dcr.ssa_jkws}}</SoftwareStatementJWKS>
+            {% endif %}
+            {% if oauth.dcr.enable_fapi_validation%}
+            <EnableFAPIEnforcement>{{oauth.dcr.enable_fapi_validation}}</EnableFAPIEnforcement>


lets rename this to enable_fapi_enforcement

since we are adding defaults no need to check is defined. Lets remove is defined checks for configs with default values

janakamarasena · 2023-10-11T16:29:09Z

...tity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json

@@ -240,6 +240,8 @@
  "oauth.oidc.fapi.allowed_client_authentication_methods": ["private_key_jwt", "tls_client_auth"],
  "oauth.oidc.fapi.allowed_signature_algorithms": ["PS256", "ES256"],

+  "oauth.oidc.fapi.enable_validation": false,


let's set this to true by default.

janakamarasena · 2023-10-11T16:31:11Z

features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2

@@ -885,6 +885,13 @@
                        <AllowedSignatureAlgorithm>{{algorithm}}</AllowedSignatureAlgorithm>
                    {% endfor %}
                </AllowedSignatureAlgorithms>
+                {% if oauth.oidc.fapi.enable_validation is defined %}
+                <EnableFAPIValidation>{{oauth.oidc.fapi.enable_validation}}</EnableFAPIValidation>


lets move this config to the top of the FAPI configs

jenkins-is-staging · 2023-10-12T05:27:48Z

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/6491648776

jenkins-is-staging · 2023-10-12T07:37:20Z

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6491648776
Status: success

jenkins-is-staging

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/6491648776

SachiniSiriwardene added 3 commits October 5, 2023 20:26

add config changes for dcr validations

a5fd1a1

remove config

9987c99

add config to enable fapi in dcr

86440ee

janakamarasena reviewed Oct 10, 2023

View reviewed changes

SachiniSiriwardene added 3 commits October 11, 2023 11:56

change configuration name

c958440

add configuration to enable FAPI validations

5e830b2

janakamarasena reviewed Oct 11, 2023

View reviewed changes

SachiniSiriwardene added 2 commits October 11, 2023 22:48

fix pr comments

2f196cd

move sector identiier validation to dcr

823db2c

janakamarasena approved these changes Oct 12, 2023

View reviewed changes

jenkins-is-staging approved these changes Oct 12, 2023

View reviewed changes

janakamarasena merged commit 117422c into wso2:master Oct 13, 2023
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add DCR configurations #4977

Add DCR configurations #4977

SachiniSiriwardene commented Oct 7, 2023

janakamarasena Oct 10, 2023

SachiniSiriwardene Oct 11, 2023

janakamarasena Oct 10, 2023

SachiniSiriwardene Oct 11, 2023

janakamarasena Oct 10, 2023

SachiniSiriwardene Oct 11, 2023

janakamarasena Oct 11, 2023

janakamarasena Oct 11, 2023

janakamarasena Oct 11, 2023

janakamarasena Oct 11, 2023

jenkins-is-staging commented Oct 12, 2023

jenkins-is-staging commented Oct 12, 2023

jenkins-is-staging left a comment

	{% if oauth.dcr.ssa_jkws%}
	{% if oauth.dcr.ssa_jkws is defined %}

Add DCR configurations #4977

Add DCR configurations #4977

Conversation

SachiniSiriwardene commented Oct 7, 2023

Proposed changes in this pull request

When should this PR be merged

Follow up actions

Checklist (for reviewing)

General

Functionality

Code

Tests

Security

Documentation

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenkins-is-staging commented Oct 12, 2023

jenkins-is-staging commented Oct 12, 2023

jenkins-is-staging left a comment

Choose a reason for hiding this comment