TIB : How to include meta data in the token

fmeriot · May 25, 2016, 3:21pm

Hello,
I have a TIB node installed which communicates with a custom identity provider.
This Custom IDP returns a json like this :

{
  "granted": "true",
  "userid": 12345,
  "user_name": "fmeriot",
  "access_token": "123456789"
}

When I request a token on my TIB at http://{TIB-IP}:3010/auth/{profile-id}/proxy I successfully recieve a token. But, when I inspect this token, I only retrieve this meta data :

As you can see, I only have AccessToken (123456789) and user_name (as AuthProviderUserID) in my token.

How can I do to include the missing fields (“granted” and “userid” fields)?

Thank you for your help

Fred

Martin · May 25, 2016, 4:09pm

Short answer: No, unfortunately TIB currently only extracts those two fields for the proxy provider :-/

Longer answer:

In TIB, the “provider” is separated from the “handler”, and they interchange a uniform object goth.User, the TIB Proxy provider currently only deserialises for the two name spaces (access token and user ID).

If you’re up for some tinkering, it can be extended here:

github.com

TykTechnologies/tyk-identity-broker/blob/master/providers/proxy.go#L140


      
          			p.respondFailure(rw, r)
          			return
          		}
          	}
          
          
	if p.config.OKRegex != "" {
          		thisRegex, rErr := regexp.Compile(p.config.OKRegex)
          		if rErr != nil {
          			proxyLogger.WithField("error", err).Error("Regex failure")
          			p.respondFailure(rw, r)
          			return
          		}
          
          
		found := thisRegex.MatchString(string(thisBody))
          
          
		if !found {
          			proxyLogger.Error("Regex not found")
          			p.respondFailure(rw, r)
          			return
          		}
          	}

(gabs is a handy little library that lets you access JSON using dot-notation). The goth.User object is in the gothic library here:

github.com

markbates/goth/blob/master/user.go#L14


      
          	"encoding/gob"
          	"time"
          )
          
          
func init() {
          	gob.Register(User{})
          }
          
          
// User contains the information common amongst most OAuth and OAuth2 providers.
          // All the "raw" data from the provider can be found in the `RawData` field.
          type User struct {
          	RawData           map[string]interface{}
          	Provider          string
          	Email             string
          	Name              string
          	FirstName         string
          	LastName          string
          	NickName          string
          	Description       string
          	UserID            string
          	AvatarURL         string

We standardised o it because it works for all of the OAuth / Social connectors and encapsulates things quite nicely.

If you don’t want to modify TIB (and I don’t blame you), then the only thing I could think of doing is to serialise the full user data as a b64 string into the user-id field in your IDP so that you can extract it at your service layer, but that might not be very palatable.

fmeriot · May 26, 2016, 6:26am

Ok, I will encode my custom DTO in the access_toke field.

Thank you