Merge remote-tracking branch 'upstream/master'

RushanNanayakkara · RushanNanayakkara · commit c045736f761c · 2025-08-12T15:47:18.000+05:30
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.analytics/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.analytics/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.choreo/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.choreo/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.common/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.common/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.elk/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.elk/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.http/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.http/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.jwt.decode/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.jwt.decode/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.notification/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.notification/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.session/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.session/pom.xml
@@ -20,7 +20,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.test.utils/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.test.utils/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/GetUsersWithClaimValuesFunction.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/GetUsersWithClaimValuesFunction.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2025, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.carbon.identity.conditional.auth.functions.user.store;
+
+import org.wso2.carbon.identity.application.authentication.framework.config.model.graph.js.JsAuthenticatedUser;
+import org.wso2.carbon.identity.application.authentication.framework.config.model.graph.js.JsAuthenticationContext;
+import org.wso2.carbon.identity.application.authentication.framework.exception.FrameworkException;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Function to retrieve a list of users with provided claim values.
+ */
+@FunctionalInterface
+public interface GetUsersWithClaimValuesFunction {
+
+    /**
+     * Get a list of users who have the claim values as provided in the adaptive script.
+     *
+     * @param claimMap                  Map of claims and its values.
+     * @param authenticationContext     Authentication context object
+     * @param parameters                Additional parameters provided from the adaptive script.
+     */
+    List<JsAuthenticatedUser> getUsersWithClaimValues(Map<String, String> claimMap,
+                                                      JsAuthenticationContext authenticationContext,
+                                                      String... parameters) throws FrameworkException;
+}
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/GetUsersWithClaimValuesFunctionImpl.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/GetUsersWithClaimValuesFunctionImpl.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2025, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.carbon.identity.conditional.auth.functions.user.store;
+
+import java.util.List;
+import java.util.Map;
+import org.graalvm.polyglot.HostAccess;
+import org.wso2.carbon.identity.application.authentication.framework.config.model.graph.js.JsAuthenticatedUser;
+import org.wso2.carbon.identity.application.authentication.framework.config.model.graph.js.JsAuthenticationContext;
+import org.wso2.carbon.identity.application.authentication.framework.exception.FrameworkException;
+
+/**
+ * Implementation of GetUsersWithClaimValuesFunction interface. This returns a list of users with provided claim values.
+ */
+public class GetUsersWithClaimValuesFunctionImpl implements GetUsersWithClaimValuesFunction {
+
+    @Override
+    @HostAccess.Export
+    public List<JsAuthenticatedUser> getUsersWithClaimValues(Map<String, String> claimMap,
+                                                             JsAuthenticationContext authenticationContext,
+                                                             String... parameters) throws FrameworkException {
+
+        return new UserStoreFunctions().getUsersWithClaimValues(claimMap, authenticationContext, parameters);
+    }
+}
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/UserStoreFunctions.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/UserStoreFunctions.java
@@ -144,4 +144,124 @@ private JsAuthenticatedUser getUniqueUserWithClaimValuesInternal(Map<String, Str
         return null;
     }
 
+    /**
+     * Get list of authenticated users list according to the values provided for the claim values.
+     *
+     * @param claimMap      Map of claims with its values.
+     * @param parameters    Additional parameters including AuthenticationContext object.
+     */
+    protected List<JsAuthenticatedUser> getUsersWithClaimValues(Map<String, String> claimMap, Object... parameters)
+            throws FrameworkException {
+
+        JsAuthenticationContext authenticationContext = null;
+        String tenantDomain = null;
+        String profile = "default";
+
+        if (claimMap == null || parameters == null) {
+            if (LOG.isDebugEnabled()) {
+                LOG.debug("Passed parameter to getUsersWithClaimValues method has null values.");
+            }
+            return null;
+        }
+
+        if (parameters.length == 2) {
+            if (parameters[0] instanceof JsAuthenticationContext) {
+                authenticationContext = (JsAuthenticationContext) parameters[0];
+                tenantDomain = authenticationContext.getContext().getTenantDomain();
+            }
+            if (parameters[1] instanceof String) {
+                profile = (String) parameters[1];
+            }
+        }
+
+        if (parameters.length == 1 && parameters[0] instanceof JsAuthenticationContext) {
+            authenticationContext = (JsAuthenticationContext) parameters[0];
+            tenantDomain = authenticationContext.getContext().getTenantDomain();
+        }
+
+        if (tenantDomain != null) {
+
+            int tenantId = IdentityTenantUtil.getTenantId(tenantDomain);
+            try {
+                List<String> selectedUsers = new ArrayList<>();
+                UserRealm userRealm = UserStoreFunctionsServiceHolder.getInstance().getRealmService()
+                        .getTenantUserRealm(tenantId);
+
+                if (userRealm != null) {
+                    UserStoreManager userStoreManager = (UserStoreManager) userRealm.getUserStoreManager();
+                    // Get the user list using the first claim value.
+                    Map.Entry<String, String> claimEntry = claimMap.entrySet().iterator().next();
+                    String firstClaim = claimEntry.getKey();
+                    String firstClaimValue = claimEntry.getValue();
+                    claimMap.remove(firstClaim);
+                    String[] userList = userStoreManager.getUserList(firstClaim, firstClaimValue, profile);
+
+                    if (userList == null) {
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug("No matching users identified for the first claim value provided.");
+                        }
+                        return null;
+                    }
+
+                    selectedUsers.addAll(Arrays.asList(userList));
+
+                    for (String username: userList) {
+                        for (Map.Entry<String, String> entry : claimMap.entrySet()) {
+                            String userClaimValue = userStoreManager.getUserClaimValue(username, entry.getKey(),
+                                    profile);
+                            if (userClaimValue == null || !userClaimValue.equals(entry.getValue())) {
+                                selectedUsers.remove(username);
+                                break;
+                            }
+                        }
+                    }
+
+                    if (selectedUsers.isEmpty()) {
+                        if (LOG.isDebugEnabled()) {
+                            LOG.debug("No matching users were identified with the provided claim values.");
+                        }
+                        return null;
+                    }
+
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug(selectedUsers.size() +
+                                " users were identified matching to the provided claim values");
+                    }
+
+                    List<JsAuthenticatedUser> authenticatedUserList = new ArrayList<>();
+                    for (String username : selectedUsers) {
+
+                        AuthenticatedUser authenticatedUser = new AuthenticatedUser();
+                        if (username.indexOf(CarbonConstants.DOMAIN_SEPARATOR) > 0) {
+                            String[] subjectIdentifierSplits = username.split(CarbonConstants.DOMAIN_SEPARATOR, 2);
+                            authenticatedUser.setUserStoreDomain(subjectIdentifierSplits[0]);
+                            username = subjectIdentifierSplits[1];
+                        } else {
+                            authenticatedUser.setUserStoreDomain(IdentityUtil.getPrimaryDomainName());
+                        }
+
+                        authenticatedUser.setUserName(username);
+                        authenticatedUser.setTenantDomain(tenantDomain);
+                        authenticatedUserList.add((JsAuthenticatedUser) JsWrapperFactoryProvider.getInstance()
+                                .getWrapperFactory().createJsAuthenticatedUser(
+                                        authenticationContext.getWrapped(), authenticatedUser));
+                    }
+
+                    return authenticatedUserList;
+
+                } else {
+                    LOG.error("Cannot find the user realm for the given tenant: " + tenantId);
+                }
+            } catch (UserStoreException e) {
+                String msg = "getUsersWithClaimValues Function failed while getting user attributes ";
+                if (LOG.isDebugEnabled()) {
+                    LOG.debug(msg, e);
+                }
+                throw new FrameworkException(msg, e);
+            }
+        }
+
+        return null;
+    }
+
 }
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/internal/UserStoreFunctionsServiceComponent.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user.store/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/store/internal/UserStoreFunctionsServiceComponent.java
@@ -29,6 +29,7 @@
 import org.osgi.service.component.annotations.ReferencePolicy;
 import org.wso2.carbon.identity.application.authentication.framework.JsFunctionRegistry;
 import org.wso2.carbon.identity.conditional.auth.functions.user.store.GetUserWithClaimValuesV2FunctionImpl;
+import org.wso2.carbon.identity.conditional.auth.functions.user.store.GetUsersWithClaimValuesFunctionImpl;
 import org.wso2.carbon.user.core.service.RealmService;
 
 /**
@@ -53,6 +54,8 @@ protected void activate(ComponentContext ctxt) {
 
             jsFunctionRegistry.register(JsFunctionRegistry.Subsystem.SEQUENCE_HANDLER, "getUniqueUserWithClaimValues",
                     new GetUserWithClaimValuesV2FunctionImpl());
+            jsFunctionRegistry.register(JsFunctionRegistry.Subsystem.SEQUENCE_HANDLER, "getUsersWithClaimValues",
+                    new GetUsersWithClaimValuesFunctionImpl());
         } catch (Throwable e) {
             LOG.error("Error occurred during conditional authentication user functions bundle activation. ", e);
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.user/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.conditional.auth.functions</groupId>
         <artifactId>identity-conditional-auth-functions</artifactId>
-        <version>1.2.81-SNAPSHOT</version>
+        <version>1.2.82-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/RemoveAssociatedLocalUserFunction.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/RemoveAssociatedLocalUserFunction.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2025, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.carbon.identity.conditional.auth.functions.user;
+
+import org.wso2.carbon.identity.application.authentication.framework.config.model.graph.js.JsAuthenticatedUser;
+
+/**
+ * Function to remove association with the local user for a federated user.
+ */
+@FunctionalInterface
+public interface RemoveAssociatedLocalUserFunction {
+
+    /**
+     * Remove association to the local user with federated user.
+     *
+     * @param federatedUser     Federated user.
+     */
+    boolean removeAssociatedLocalUser(JsAuthenticatedUser federatedUser);
+}
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/RemoveAssociatedLocalUserFunctionImpl.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/RemoveAssociatedLocalUserFunctionImpl.java
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.user/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/internal/UserFunctionsServiceComponent.java b/components/org.wso2.carbon.identity.conditional.auth.functions.user/src/main/java/org/wso2/carbon/identity/conditional/auth/functions/user/internal/UserFunctionsServiceComponent.java
diff --git a/components/org.wso2.carbon.identity.conditional.auth.functions.utils/pom.xml b/components/org.wso2.carbon.identity.conditional.auth.functions.utils/pom.xml
diff --git a/features/org.wso2.carbon.identity.conditional.auth.functions.server.feature/pom.xml b/features/org.wso2.carbon.identity.conditional.auth.functions.server.feature/pom.xml
diff --git a/pom.xml b/pom.xml
