How to create authorization roles from OIDC token in WebSphere Liberty server application using social login feature? - authorization

Question

I am trying to implement role based authorization in an application running on WebSphere / Open Liberty server. Authentication is implemented using OIDC token & socual-login feature & it is workig fine. I am struggling to create roles from JWT token & depending on that authorizing access to different servlets.
My server.xml -
<server description="new server">
<!-- Enable features -->
<featureManager>
<feature>appSecurity-3.0</feature>
<feature>socialLogin-1.0</feature>
<feature>microProfile-4.1</feature>
<feature>jsp-2.3</feature>
<feature>localConnector-1.0</feature>
</featureManager>
<logging traceSpecification="*=info" consoleLogLevel="INFO"/>
<oidcLogin clientId="${clientId}"
clientSecret="${clientSecret}"
discoveryEndpoint="${oAuthServerUrl}/.well-known/openid-configuration"
id="liberty-aad-oidc-javaeecafe" signatureAlgorithm="RS256"
userNameAttribute="email" groupNameAttribute="role"/>
<authFilter id="myAuthFilter">
<requestUrl id="myRequestUrl" matchType="contains"
urlPattern="/*" />
</authFilter>
<keyStore id="defaultKeyStore"
password="${env.keystore_password}" />
<keyStore id="mytruststore"
location="${server.config.dir}/mytruststore.jks" password="****" />
<ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore"
trustDefaultCerts="true" trustStoreRef="mytruststore" />
<applicationManager autoExpand="true" />
<httpEndpoint host="*" httpPort="9080" httpsPort="9443"
id="defaultHttpEndpoint" />
<mpJwt id="myMpJwt"
jwksUri="${oAuthServerUrl}/publickeys"
issuer="${oAuthServerUrl}"
authFilterRef="myAuthFilter" groupNameAttribute="role"/>
<applicationMonitor updateTrigger="mbean" />
<applicationMonitor dropinsEnabled="false"/>
<webApplication contextRoot="/" id="oidcsampleapp"
location="oidcsampleapp-1.0.0.war" name="oidcsampleapp" >
<application-bnd>
<security-role name="admin-role">
<group name="admin" />
</security-role>
<!-- <security-role name="admin">
<special-subject type="ALL_AUTHENTICATED_USERS" />
</security-role> -->
</application-bnd>
</webApplication>
</server>
When using request is forwarded to application, otherwise access is denied. I am trying to create the security principal role "admin-role" which is coming along with the JWT token.
Web.xml security configuration -
<security-role>
<role-name>admin-role</role-name>
</security-role>
<security-role>
<role-name>user-role</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>AdminServlet</web-resource-name>
<url-pattern>/admin/*</url-pattern>
<http-method>GET</http-method>
<http-method>PUT</http-method>
<http-method>POST</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>admin-role</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
Roles defined above are part of the JWT token from OIDC server & mentioned in server.xml.
<security-role>
<role-name>admin-role</role-name>
</security-role>
<security-role>
<role-name>appuser-role</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>AdminServlet</web-resource-name>
<url-pattern>/admin/*</url-pattern>
<http-method>GET</http-method>
<http-method>PUT</http-method>
<http-method>POST</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>admin-role</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
JWT token received:
{
"iss": https://xxxxx.xxxxx,
"exp": 1665245032,
"aud": [
"931280e3-xxxx-xxxx-xxxxx-xxxxxxx"
],
"sub": "xxxxx-xxxx-xxxxxxx-xxxx-xxxxxxxxx",
"amr": [
"saml"
],
"iat": 1665241432,
"tenant": "xxxxxxxxx",
"scope": "openid appid_default appid_readuserattr appid_readprofile appid_writeuserattr appid_authenticated",
"role": "admin-role",
"surname": "Basu",
"groups": [
"014a0054-942f-4c20-a6e0-235dd906ca1c"
],
"entityID": https://sts.windows.net/81fa766e-a349-4867-8bf4-ab35e250a08f/
}