Add refresh token support for impersonation flow #2950
Conversation
![wso2-engineering[bot]](https://avatars.githubusercontent.com/in/1856828?s=60&v=4){kind=small}
...in/java/org/wso2/carbon/identity/oauth/tokenprocessor/DefaultRefreshTokenGrantProcessor.java
Outdated
Show resolved
Hide resolved
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
Show resolved
Hide resolved
...arbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/token/JWTTokenIssuer.java
Show resolved
Hide resolved
.../org/wso2/carbon/identity/oauth2/token/handlers/grant/AbstractAuthorizationGrantHandler.java
Show resolved
Hide resolved
.../src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandler.java
Show resolved
Hide resolved
.../src/main/java/org/wso2/carbon/identity/oauth2/token/handlers/grant/RefreshGrantHandler.java
Show resolved
Hide resolved
...so2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/util/OAuth2Util.java
Show resolved
Hide resolved
There was a problem hiding this comment.
AI Agent Log Improvement Checklist
- The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
- Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.
✅ Before merging this pull request:
- Review all AI-generated comments for accuracy and relevance.
- Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
Codecov Report❌ Patch coverage is ❌ Your patch status has failed because the patch coverage (25.00%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #2950 +/- ##
============================================
- Coverage 58.21% 57.56% -0.66%
- Complexity 9057 9175 +118
============================================
Files 669 669
Lines 50211 51374 +1163
Branches 11430 11711 +281
============================================
+ Hits 29231 29574 +343
- Misses 16947 17673 +726
- Partials 4033 4127 +94
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
LGTM |
| * | ||
| * @return True if impersonated refresh token is enabled. | ||
| */ | ||
| public static boolean isImpersonatedRefreshTokenEnabled() { |
There was a problem hiding this comment.
Shouldn't this be a app level config?
There was a problem hiding this comment.
we are not introducing app level config with this PR, cause for app level config we have to change API, UI and integration tests and it would take a week to do it
|
PR builder started |
|
PR builder completed |
|
Tested scenarios MyAccount ImpersonationScreen.Recording.2025-10-06.at.18.07.14.movApp SSO impersonation3.mp4Refresh grant flow2.mp4 |
|
PR builder started |
|
PR builder completed |
|
PR builder started |
|
PR builder completed |
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/18290073469
Proposed changes in this pull request
Issue: wso2/product-is#25778
This pull request introduces enhancements and refactoring to the impersonated refresh token feature in the OAuth2 implementation. The main focus is on improving how impersonation requests are detected and handled, ensuring consistent propagation of impersonation information, and making the configuration for enabling impersonated refresh tokens more robust and clear.
Impersonation Feature Improvements:
isImpersonatedRefreshTokenEnabled()inOAuth2Utilto centralize and simplify checking whether impersonated refresh tokens are enabled, with support for a default value.Impersonation Information Propagation:
propagateImpersonationInfo()inRefreshGrantHandlerto detect and mark impersonation requests by inspecting extended attributes, ensuring impersonation context is set correctly during token generation. [1] [2]Refactoring and Code Consistency:
AbstractAuthorizationGrantHandlerto use the new utility method for checking impersonated refresh token enablement, replacing direct property access for improved code clarity and maintainability. [1] [2]Token Attribute Handling:
DefaultRefreshTokenGrantProcessor, improving how custom token attributes are handled during token creation. [1] [2]JWTTokenIssuerto remove the impersonating actor from custom claims before issuing JWTs, preventing unintended exposure of impersonation details.Todo
[x] - unit test
[ ] - integration test
Tested Flows
Can found the flows in here