How to parse API /v1/oauth2 response?

[dvv]

Hi!

I wonder what format is used for oauth2_rs_XXX_map in the following response to GET /v1/oauth2/ess-dev:

{
  "attrs": {
    ...
    "oauth2_rs_claim_map": [
      "role: a216385e-353c-4077-a206-af3662eaffc6 \"\"ess_web\"\""
    ],
    "oauth2_rs_scope_map": [
      "project-ess-users: {\"email\", \"openid\", \"profile\"}"
    ],
    "oauth2_rs_sup_scope_map": [
      "project-ess-admins: {\"can_unlock_any\"}",
      "project-ess-users: {\"can_lock\", \"can_read\", \"can_unlock\"}",
      "project-ess-managers: {\"can_update\"}"
    ],
    ...
  }
}

TIA

[yaleman]

Oh, that's serde_json serializing the entries ... it's a problem. 😢

[Firstyear]

That because this is the proto entry api, so we have to flatten inner structure with another round of json.

This is why we want to implement scim.

[yaleman]

There's some slightly janky but functional python code showing how to parse it in the pykanidm oauth2 tests -

kanidm/pykanidm/tests/test_oauth2.py

Line 49 in 5701da8

print(f"oauth2_rs_sup_scope_map: {mapping}")

[Firstyear]

Fixed by #211

[Firstyear]

Also duplicate of #1998

[dvv]

oauth2_rs_claim_map reads group uuid not spn. Is that quick-fixable?

[Firstyear]

I'd need to check, but unlikely - the claim maps store only the reference uuid which is what we return here. To resolve this to an absolute spn, we need some extra parts in place.

[Firstyear]

Actually, it doesn't seem too bad, just needs something in resolve_valueset.

[dvv]

I see. I believe someday it should be dereferenced internally for consistency.

[Firstyear]

Yes, that would be the plan.

[dvv]

How do I determine the join type of a claim as no GET /v1/oauth2/X/_claimmap/Y exposed?
If there's the only element Z in claim map it is trivially equal to ""Z"" and no separator (;,\s) seen.

[Firstyear]

The problem is this part of the api isn pretty old and was never meant to show the kind of structured data that is in oauth2claim maps, which is why scim will really make this easier. For now, either I can just put the join char in the output in a known position, or just force it to always have a trailing joiner.

[dvv]

Let it be the trailing symbol. Thank you!

[Firstyear]

What about "claim_name:spn:join_char:claim[,claim]". e.g. admin:admins@example.com:,:allowed where this is csv.

[dvv]

Looks good.