Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[1.15.x][ELY-2567] Automatically retrieve roles from an OIDC access token's "roles" claim if present #1918

Merged
merged 13 commits into from Jun 14, 2023

Conversation

fjuma
Copy link
Contributor

@fjuma fjuma commented Jun 13, 2023

fjuma and others added 13 commits June 8, 2023 10:51
Method isAutodetectedBearerOnly() should be invoked after checking cached token.

Invoking isAutodetectedBearerOnly() early will break every AJAX request that relies on HTTP session. A clear example is JSF Partial Request, it will never send the header "Authorization" neither the query parameter "auth". During the initial load of view the user was authenticated, then the token was stored in HTTP session, so, JSF Partial Request relies on HTTP session onwards.

https://issues.redhat.com/browse/ELY-2487
Signed-off-by: Patrick Reinhart <patrick@reini.net>
@fjuma fjuma merged commit 68e5df2 into wildfly-security:1.15.x Jun 14, 2023
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants