SECAUTH-1483

[nenaraab]

In spring-xsuaa

Before

Converter<Jwt, AbstractAuthenticationToken> getJwtAuthenticationConverter() {
		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsuaaServiceConfiguration);
		converter.setLocalScopeAsAuthorities(true);
		return converter;
}

New

Converter<Jwt, AbstractAuthenticationToken> getJwtAuthenticationConverter() {
          return new TokenAuthenticationConverter(new MyCustomAuthoritiesExtractor());
}

private static class MyCustomAuthoritiesExtractor implements AuthoritiesExtractor {

		@Override
		public Collection<GrantedAuthority> getAuthorities(XsuaaToken token) {
			String appId = "";
			if(token.getClientId().startsWith("sb-")) {
				appId = token.getClientId().replaceFirst("sb-", "");
			}
			AuthoritiesExtractor authoritiesExtractor = new LocalAuthoritiesExtractor(appId);
			return authoritiesExtractor.getAuthorities(token);
		}

	}

In spring-security

You can subclass XsuaaTokenAuthorizationConverter and overwrite localScopeAuthorities(Jwt jwt, Collection<String> scopes). An example is not yet available.

[liga-oz]

All looking good just couple of points to review 😉

[liga-oz]

the jwt seems to be not used in the method, is it required to have it in the argument list?

[nenaraab]

good finding!
But in this case this protected method is foreseen as "enhancement spot" and app developers may need access to other token claims.

[liga-oz]

👍🏻