product-is
product-is copied to clipboard
redirectUrl is missing in Apple Federated Authenticator for API based authentication
Describe the issue: In the API based authentication, federated authenticator responses should contain a redirectUrl inside additionalData object. As an example, for Google federated authenticators,
{
"authenticatorId": "R29vZ2xlT0lEQ0F1dGhlbnRpY2F0b3I6R29vZ2xl",
"authenticator": "Google",
"idp": "Google",
"metadata": {
"i18nKey": "authenticator.google",
"promptType": "REDIRECTION_PROMPT",
"additionalData": {
"state": "7ea52985-924d-4c1d-acb1-81dca5cf9d27,OIDC",
"redirectUrl": "https://accounts.google.com/o/oauth2/authabc?response_type=code&redirect_uri=https%3A%2F%2Flocalhost%2Fcallback&state=7ea52985-924d-4c1d-acb1-81dca5cf9d27%2COIDC&nonce=965538d6-7632-4b63-8c8e-f27a8978964d&client_id=duy7tfF8tOH1ocZNsLOFRuDPuYMa&scope=email+openid+profile"
}
},
"requiredParams": [
"code",
"state"
]
}
However, this additionalData object is missing in the Apple Federated authneticator. Users can not proceed with the next step.
{
"authenticatorId": "QXBwbGVPSURDQXV0aGVudGljYXRvcjpBcHBsZQ",
"authenticator": "Apple",
"idp": "Apple",
"metadata": {
"i18nKey": "authenticator.oidc",
"promptType": "REDIRECTION_PROMPT"
},
"requiredParams": [
"code",
"state"
]
}
Additional data is taken from the context OpenIDConnectAuthenticator [1]. The context is populated from the initiateAuthenticationRequest
method [2]. However, this is only implemented in the OpenIDConnectAuthenticator but Apple authenticator has the initiateAuthenticationRequest
overrided. Therefore, the required properties are not added to the context for Apple authenticator.
[1] - https://github.com/wso2-extensions/identity-outbound-auth-oidc/blob/a2454b2b3054cf52a01b8e7dfb3ede0b37c48658/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java#L1396-L1397 [2] - https://github.com/wso2-extensions/identity-outbound-auth-oidc/blob/a2454b2b3054cf52a01b8e7dfb3ede0b37c48658/components/org.wso2.carbon.identity.application.authenticator.oidc/src/main/java/org/wso2/carbon/identity/application/authenticator/oidc/OpenIDConnectAuthenticator.java#L550
How to reproduce:
- Create an application and enable API based authentication.
- Create an Apple federated authenticator and add it as the login option for the application.
- Initiate API based authentication.
-
additionalData
is missing in the response.
Expected behavior: Redirect url should come in the additional data object.
Environment information:
- Product Version: IS 7.0