Skip to content

Improve tenant perspective organization context rewrite configs #7566

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

Improve tenant perspective organization context rewrite configs #7566

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
49e957c
Template the org context to rewrite in tenant perspective configs
SujanSanjula96 Oct 20, 2025
6b39d10
Add authz call associated tenant perspective org context urls in disa…
SujanSanjula96 Oct 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions ...ures/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4030,22 +4030,68 @@

<OrgContextsToRewriteInTenantPerspective>
<WebApp>
{% for org_context_in_tenant_perspective in org_context_in_tenant_perspective.rewrite %}
{% for base_path in org_context_in_tenant_perspective.base_path %}
<Context>
<BasePath>{{base_path}}</BasePath>
<SubPaths>
{% for sub_path in org_context_in_tenant_perspective.sub_paths %}
Comment on lines +4033 to +4038
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The loop variable name conflicts with the parent object name 'org_context_in_tenant_perspective'. This will shadow the parent variable and make nested properties inaccessible within the loop.

Suggested change
{% for org_context_in_tenant_perspective in org_context_in_tenant_perspective.rewrite %}
{% for base_path in org_context_in_tenant_perspective.base_path %}
<Context>
<BasePath>{{base_path}}</BasePath>
<SubPaths>
{% for sub_path in org_context_in_tenant_perspective.sub_paths %}
{% for rewrite_context in org_context_in_tenant_perspective.rewrite %}
{% for base_path in rewrite_context.base_path %}
<Context>
<BasePath>{{base_path}}</BasePath>
<SubPaths>
{% for sub_path in rewrite_context.sub_paths %}

Copilot uses AI. Check for mistakes.
Comment on lines +4033 to +4038
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Due to variable shadowing in the outer loop (line 4033), this will try to access 'base_path' property on the loop item instead of the original configuration object, which will likely cause template rendering errors.

Suggested change
{% for org_context_in_tenant_perspective in org_context_in_tenant_perspective.rewrite %}
{% for base_path in org_context_in_tenant_perspective.base_path %}
<Context>
<BasePath>{{base_path}}</BasePath>
<SubPaths>
{% for sub_path in org_context_in_tenant_perspective.sub_paths %}
{% for rewrite_item in org_context_in_tenant_perspective.rewrite %}
{% for base_path in rewrite_item.base_path %}
<Context>
<BasePath>{{base_path}}</BasePath>
<SubPaths>
{% for sub_path in rewrite_item.sub_paths %}

Copilot uses AI. Check for mistakes.
<Path>{{sub_path}}</Path>
{% endfor %}
</SubPaths>
</Context>
{% endfor %}
{% endfor %}
<Context>
<BasePath>/api/</BasePath>
<SubPaths>
<Path>/api/identity/oauth2/dcr/</Path>
{% if org_context_in_tenant_perspective.authz_paths.enable is defined && org_context_in_tenant_perspective.authz_paths.enable is sameas true %}
<Path>/api/server/v1/branding-preference</Path>
<Path>/api/server/v1/branding-preference/resolve</Path>
<Path>/api/server/v1/branding-preference/text</Path>
<Path>/api/server/v1/branding-preference/text/resolve</Path>
<Path>/api/identity/auth/v1.1/data</Path>
<Path>/api/users/v1/offline-invite-link</Path>
<Path>/api/server/v1/validation-rules</Path>
<Path>/api/users/v1/me/push/devices</Path>
<Path>/api/server/v1/flow/config</Path>
<Path>/api/server/v1/identity-governance/preferences</Path>
<Path>/api/server/v1/identity-governance</Path>
{% endif %}
</SubPaths>
</Context>
<Context>
<BasePath>/oauth2/</BasePath>
<SubPaths>
{% if org_context_in_tenant_perspective.authz_paths.enable is defined && org_context_in_tenant_perspective.authz_paths.enable is sameas true %}
<Path>/oauth2/authorize</Path>
{% endif %}
<Path>/oauth2/token</Path>
<Path>/oauth2/introspect</Path>
<Path>/oauth2/revoke</Path>
<Path>/oauth2/userinfo</Path>
</SubPaths>
</Context>
</WebApp>
<Servlet>
{% for servlet in org_context_in_tenant_perspective.rewrite.servlets %}
<Context>{{servlet}}</Context>
{% endfor %}
{% for servlet in org_context_in_tenant_perspective.rewrite.custom_servlets %}
<Context>{{servlet}}</Context>
{% endfor %}
Comment on lines +4077 to +4083
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These loops assume that 'org_context_in_tenant_perspective.rewrite.servlets' and 'org_context_in_tenant_perspective.rewrite.custom_servlets' are iterable collections, but there's no validation to ensure these properties exist or are properly structured.

Suggested change
<Servlet>
{% for servlet in org_context_in_tenant_perspective.rewrite.servlets %}
<Context>{{servlet}}</Context>
{% endfor %}
{% for servlet in org_context_in_tenant_perspective.rewrite.custom_servlets %}
<Context>{{servlet}}</Context>
{% endfor %}
<Servlet>
{% if org_context_in_tenant_perspective.rewrite.servlets is defined and org_context_in_tenant_perspective.rewrite.servlets %}
{% for servlet in org_context_in_tenant_perspective.rewrite.servlets %}
<Context>{{servlet}}</Context>
{% endfor %}
{% endif %}
{% if org_context_in_tenant_perspective.rewrite.custom_servlets is defined and org_context_in_tenant_perspective.rewrite.custom_servlets %}
{% for servlet in org_context_in_tenant_perspective.rewrite.custom_servlets %}
<Context>{{servlet}}</Context>
{% endfor %}
{% endif %}

Copilot uses AI. Check for mistakes.
{% if org_context_in_tenant_perspective.authz_paths.enable is defined && org_context_in_tenant_perspective.authz_paths.enable is sameas true %}
<Context>/commonauth(.*)</Context>
<Context>/logincontext(.*)</Context>
<Context>/samlsso(.*)</Context>
<Context>/identity/metadata/saml2</Context>
<Context>/identity/oidc/slo</Context>
<Context>/longwaitstatus(.*)</Context>
<Context>/oidc/</Context>
<Context>/push-auth/(.*)</Context>
{% endif %}
</Servlet>
</OrgContextsToRewriteInTenantPerspective>

<OrgContextsToRewrite>
Expand Down
4 changes: 3 additions & 1 deletion ...y.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2155,5 +2155,7 @@
"notificationChannel.sms.custom.connection_timeout": "5000",
"notificationChannel.sms.custom.connection_read_timeout": "20000",

"configs.endpoint.elevate_permission": true
"configs.endpoint.elevate_permission": true,

"org_context_in_tenant_perspective.authz_paths.enable": false
}