Tech Journey

In previous wso2 IS versions OIDC scope-claim mapping is maintained in the registry level. From IS 5.7.0 this mapping will be persisted in the db layer. How OIDC scope-claim mapping works? In the location of {product_home}/repository/conf/identity the file oidc-scope-config.xml can be found with the default OIDC scope claim mappings. In the very first server startup scopes and claims defined in this file will be stored in the db and the same data will be displayed in the management console UI. In the tenant creation also the data which is defined in the aforementioned file will be stored in the db against the tenant id. After the very server start up and the tenant creation the changes done to the oidc-scope-config.xml wont get affected. So adding, removing and editing oidc scopes should be done through the Management console UI. OIDC Scope-Claim Mapping UI. In the management console under 'Manage' collapsing panel it can be seen 'OIDC Scopes' section as below. ...

Purpose of Request Object in OIDC Usually in OIDC the returning claims will be filtered from the requested scopes that is passed to the server as an query param with the authorization request. When it comes to wso2 IS server, it filters the requested claims both from the requested scopes defined with the authorization request and the requested claims that can be configured in service provider configurations. But if Request Object is associated with the authorization request, then the server will return the essential request object claims if those claims are requested from the scope. This request object can be either 1.  request parameter (Passed by value) 2.  request_uri parameter (Passed by reference) 'request' parameter As we previously discussed the main purpose of this parameter is for supporting to request some claims other than the default Userinfo and IdToken claim set which is associated with the requested scope. This parameter value can be a pure j...

What is JWKS endpoint? The JSON Web Key Set (JWKS) endpoint is a read-only endpoint. This url returns the Identity Server's public key set in Json web key set format. This contains the signing key(s) the RP uses to validate signatures from the Identity Server. This endpoint is defined loosely by the OpenID Connect Discovery specification . Try JWKS endpoint with Identity Server The endpoint url for the super tenant: https://localhost:9443/oauth2/jwks The jwks for the super tenant will be as follows: { "keys" : [ { "alg" : "RS256" , "kty" : "RSA" , "use" : "sig" , "n" : " AJSn-hXW9Zzz9ORBKIC9Oi6wzM4zhqwHaKW2vZAqjOeLlpUW7zXwyk4tkivwsydPNaWUm-9oDlEAB2lsQJv7jwWNsF7SGx5R03kenC-cf8Nbxlxwa-Tncjo6uruEsK_Vke244KiSCHP8BOuHI-r5CS0x9edFLgesoYlPPFoJxTs5 " , "e" : "AQAB" , "kid" : " d0ec514a32b6f88c0abd12a2840699bdd3deba9d "...