Conditional claim handling

[ruwanta]

Conditional Authentication needs to support claim handling.

1. Allow read claims in javascript
2. Add/Modify/Delete existing claims in Authentication Context

[ruwanta]

Documentation

Usually you will want to generate new claims or change a claim value after an existing authentication is successful.
E.g.
Generate the “Display Name” when you have “First Name” and “Last Name”
Generate “Age” when you have “Date Of Birth”

You are provided two array view of the claims

• Array view with local claim URI
• Array view with remote claim URI

Accessing a claim by local claim uri

var myClaimValueX = context.subject.claims.local['http://wso2.org/claims/<x>];

Accessing a claim by remote claim uri

var myClaimValueX = context.subject.claims.remote['http://some.domain.you/claims/<x>];

Adding a new claim to the claim set

var newClaim = {}
//Populate claim values, remote and local URI with valid value.
...
context.subject.claims.push(newClaim)

Example

Create the "Display Name" and attach it as a new claim, by using the first name and last name of the authenticated user.

function onInitialRequest (context) {
   executeStep({id :'1',
       on : {
           success : function(context) {
               Log.info('First Authentication success');
               var fName = context.subject.claims.local['http://wso2.org/claims/givenname'];
               var lName = context.subject.claims.local['http://wso2.org/claims/lastname'];
               var displayName = fName + ' '+ lName + ' by Javascript';
               var newClaim = {'local' : {}, 'remote': {}};
               newClaim.remote.uri = 'http://your.domain.some/claims/displayName';
               newClaim.local.uri = 'http://wso2.org/claims/displayName';
               newClaim.value = displayName;

               Log.info('Display Name: '+displayName);
               context.subject.claims.push(newClaim)
           }
       }
   });
}