search

wso2 / product-apim

Welcome to the WSO2 API Manager source code! For info on working with the WSO2 API Manager repository and contributing code, click the link below.
http://wso2.github.io/
Apache License 2.0
846 stars 785 forks source link

Application/* roles are getting removed upon federated users re-login to servers #4402

Closed malinthaprasan closed 5 years ago

malinthaprasan commented 5 years ago

Description: In SSO (federated) setup where user stores are not shared and provisioning is enabled, the Application/* roles are removed from users when they re-login. Due to this, the users are unable to delete/update OAuth applications created in Store after re-login.

The reason for the issue is the current DefaultProvisioningHandler.java doesn't consider skipping Application/* roles when updating roles of user (when re-login).

OS, DB, other environment details and versions:
SSO, Federated, JIT Provisioning

Steps to reproduce:

  1. Created an SSO setup enabling provisioning
  2. Log into Store using a user with SSO
  3. Create an application and generate keys

Now check from the carbon console for the particular user. The application role is assigned to the particular user.

  1. Logout from the Store.
  2. Again login to the store with the same user.

Now check from the carbon console for the particular user. The application role is not assigned to the particular user.

praminda commented 5 years ago

Fixed with wso2/carbon-identity-framework#2084

josecu08 commented 3 years ago

I'm having this issues on Apim 4.0.0. I have configured wso2 is using the guide in the docs. However, when I create an application using devportal with api_user I cannot edit the application upon relogin. I've checked in management console that after a login the application/* role is not assigned anymore.

praminda commented 3 years ago

pls configure org.wso2.carbon.identity.application.authentication.framework.handler.provisioning.impl.SystemRolesRetainedProvisionHandler.java as the provisioning handler. It should resolve the issue.