IBM Security Verify

 View Only

  • 1.  Possibility to change claim value

    Posted Fri December 28, 2018 08:23 AM

    Hi all,
    I configured an OpenId connect provider with access code flow to receive an Access token, Refresh Token and ID token.
    we realized that, adding the claims in the mapping rules as following all the documentations, we have a strange behavior:
    after receive the first AT,RF,IT if the user ask for the page:
    https://webseal/mga/sps/mga/user/mgmt/html/device/grant_attributes.html?
    the user can change the content of the claim:


    It's possible to change the value choosing "update".If  the user do a request to receive a new Refresh Token, ID Token , Access Token, using the previous Refresh token, the new ID Token has the claims populated with the value modified manually.
    I saw that the default behavior is that  the attributes are all writable, but can we do something to change this behavior? At the moment we decide to add an ACL to disable tha access to the page, but we thing that it's a really security problem, someone had the same problem?


    thank you
    Ivana



    ------------------------------
    Ivana Campolongo
    ------------------------------


  • 2.  RE: Possibility to change claim value

    Posted Mon February 25, 2019 12:23 AM
    Disabling access to the grant attributes API is the correct approach if you don't want them to be user-editable. There are other cases where user-editable attributes are the desired behaviour.

    ------------------------------
    Shane Weeden
    IBM
    ------------------------------

    Original Message


  • 3.  RE: Possibility to change claim value

    Posted Wed February 27, 2019 01:54 AM

    Hi Ivana, 

    The issue you're encountering was fixed in 9.0.6.0. All new grants will add the attributes as readonly when the advanced configuration oauth20.legacyAttributeHandling is set to false. Setting this value to false will not modify any existing grant. 

    You can read more about this configuration option here: 
    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.6/com.ibm.isam.doc/config/reference/ref_aac_advcfgprop.html#aac_advcfgprop__d9571e1332


    I hope this helps. 

    Thank you



    ------------------------------
    Leo Farrell
    ------------------------------

    Original Message