Skip to content

providers/oauth2: evaluate property mappings in client credentials JWT flow#20979

Merged
BeryJu merged 4 commits intogoauthentik:mainfrom
Rishabh-git10:fix/oauth2-cc-property-mappings
Mar 18, 2026
Merged

providers/oauth2: evaluate property mappings in client credentials JWT flow#20979
BeryJu merged 4 commits intogoauthentik:mainfrom
Rishabh-git10:fix/oauth2-cc-property-mappings

Conversation

@Rishabh-git10
Copy link
Copy Markdown
Contributor

Details

Currently, the client_credentials flow using JWT assertions bypasses property mappings, hardcoding the generated user's attributes based solely on the sub claim and application name.

This PR updates __create_user_from_jwt to leverage the core SourceMapper engine. It now properly evaluates configured user property mappings and applies them to the generated service account, aligning this flow's behavior with standard Authentik logins.

  • Replaced manual user attribute assignment with SourceMapper().build_object_properties().
  • Added unit tests to verify correct mapping extraction from the incoming JWT payload.

closes #18767


Checklist

  • Local tests pass (ak test authentik/)
  • The code has been formatted (make lint-fix)

If an API change has been made

  • The API schema has been updated (make gen-build)

If changes to the frontend have been made

  • The code has been formatted (make web)

If applicable

  • The documentation has been updated
  • The documentation has been formatted (make docs)

@Rishabh-git10 Rishabh-git10 requested a review from a team as a code owner March 18, 2026 12:26
@netlify
Copy link
Copy Markdown

netlify Bot commented Mar 18, 2026

Deploy Preview for authentik-docs ready!

Name Link
🔨 Latest commit 312bca0
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/69ba9a03ecb00f0008dc4376
😎 Deploy Preview https://deploy-preview-20979--authentik-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@BeryJu BeryJu changed the title fix(providers/oauth2): evaluate property mappings in client credentials JWT flow providers/oauth2: evaluate property mappings in client credentials JWT flow Mar 18, 2026
BeryJu added 3 commits March 18, 2026 14:30
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Copy link
Copy Markdown
Member

@BeryJu BeryJu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, made a couple small changes:

  • Always top level imports unless they're needed inline to avoid circular imports
  • clamp the username at its max length (technically an unrelated change)
  • keep the original test case and change your modification into a new test case

@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 18, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.44%. Comparing base (9584cee) to head (c8aa8d1).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #20979      +/-   ##
==========================================
- Coverage   93.49%   93.44%   -0.06%     
==========================================
  Files         993      993              
  Lines       56126    56146      +20     
==========================================
- Hits        52477    52467      -10     
- Misses       3649     3679      +30     
Flag Coverage Δ
conformance 37.39% <8.33%> (-0.01%) ⬇️
e2e 42.88% <8.33%> (-0.03%) ⬇️
integration 22.16% <0.00%> (-0.06%) ⬇️
unit 91.69% <100.00%> (+<0.01%) ⬆️
unit-migrate 91.79% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Comment thread authentik/providers/oauth2/views/token.py
@rissson rissson requested a review from BeryJu March 18, 2026 14:26
@BeryJu BeryJu merged commit e6c625a into goauthentik:main Mar 18, 2026
101 checks passed
@Rishabh-git10 Rishabh-git10 deleted the fix/oauth2-cc-property-mappings branch March 18, 2026 20:27
kensternberg-authentik added a commit that referenced this pull request Mar 18, 2026
* main: (21 commits)
  providers/oauth2: evaluate property mappings in client credentials JWT flow (#20979)
  core: bump ujson from 5.11.0 to 5.12.0 (#20980)
  website: bump the build group in /website with 3 updates (#20963)
  core: bump goauthentik.io/api/v3 to 3.2026.5.0-rc1-1773774443 (#20955)
  ci: bump calibreapp/image-actions from d9c8ee5c3dc52ae4622c82ead88d658f4b16b65f to 03c976c29803442fc4040a9de5509669e7759b81 (#20970)
  core: bump library/golang from `9c51d8b` to `96b2878` in /lifecycle/container (#20972)
  core: bump library/node from `407d745` to `394048f` in /website (#20973)
  core: bump library/nginx from `bc45d24` to `dec7a90` in /website (#20974)
  core: bump github.com/go-ldap/ldap/v3 from 3.4.12 to 3.4.13 (#20962)
  core: bump google-api-python-client from 2.192.0 to 2.193.0 (#20964)
  web: bump @sentry/browser from 10.43.0 to 10.44.0 in /web in the sentry group across 1 directory (#20965)
  core: bump django-tenants from 3.10.0 to 3.10.1 (#20966)
  core: bump coverage[toml] from 7.13.4 to 7.13.5 (#20967)
  core: bump goauthentik/fips-debian from `e06f0fe` to `a613b75` in /lifecycle/container (#20968)
  core: bump sentry-sdk from 2.54.0 to 2.55.0 (#20969)
  core: bump goauthentik/fips-python from `08bc05d` to `ec5c4cd` in /lifecycle/container (#20971)
  web: Fix admin table horizontal scrolling (#20960)
  core: bump pyasn1 from 0.6.2 to 0.6.3 (#20956)
  tasks: fix workers API URL missing trailing / (#20954)
  web: Supply our font and color choices to rapidoc. (#20775)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

client_credentials grant does not apply oauth2 source property mappings

3 participants