mirror of
https://github.com/keycloak/keycloak.git
synced 2026-05-21 08:29:59 -05:00
Sven-Torben Janus
67ef87bd21
* Make OrganizationGroupMembershipMapper claim name configurable The OrganizationGroupMembershipMapper introduced in 26.6.0 hardcoded the token claim name to "organization", unlike OrganizationMembershipMapper which already exposes the claim name as a configurable property. - Add TOKEN_CLAIM_NAME config property to OrganizationGroupMembershipMapper via OIDCAttributeMapperHelper.addTokenClaimNameConfig() - Override getEffectiveModel() to default the claim name to OAuth2Constants.ORGANIZATION when not set, preserving backward compatibility for existing mapper configurations - Set TOKEN_CLAIM_NAME default in the static create() factory method - Refactor OIDCAttributeMapperHelper.getOrInitializeOrganizationClaimAsMap() to accept a ProtocolMapperModel instead of a raw String, delegating to mapClaim() for correct claim placement (including nested path support) Closes #47851 Signed-off-by: Sven-Torben Janus <sven-torben.janus@conciso.de> * Fix nested claim path read and add custom claim name tests The read side of getOrInitializeOrganizationClaimAsMap was doing a flat Map.get() on the dotted claim name, while the write side (mapClaim) already creates a nested structure by splitting on dots. This caused the group mapper to find nothing when the claim name contained a dot, overwriting the membership data written by OrganizationMembershipMapper. Fix by splitting the claim path via splitClaimPath() and traversing the nested map with a new private getNestedClaimValue() helper in OIDCAttributeMapperHelper. The helper belongs there rather than in JsonUtils because it operates on Map<String,Object>, not JsonNode. Also add integration tests covering: - Custom flat claim name ("my_orgs") for both OrganizationMembershipMapper and OrganizationGroupMembershipMapper, verifying the claim appears at the configured name and not at "organization" - Dotted claim name ("custom.org") for OrganizationGroupMembershipMapper, verifying the token contains nested otherClaims["custom"]["org"] and that group composition is preserved Signed-off-by: Sven-Torben Janus <sven-torben.janus@conciso.de> --------- Signed-off-by: Sven-Torben Janus <sven-torben.janus@conciso.de>
