for id tokens with group scope always use full arns (#2157)

AthenZ · May 2, 2023 · d96edd4 · d96edd4
1 parent 4fb424f
commit d96edd4
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java b/servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java
@@ -2012,7 +2012,7 @@ public Response getOIDCResponse(ResourceContext ctx, String responseType, String
         List<String> idTokenGroups = null;
         if (tokenRequest.isGroupsScope()) {
 
-            idTokenGroups = processIdTokenGroups(principalName, tokenRequest, domainName, fullArn,
+            idTokenGroups = processIdTokenGroups(principalName, tokenRequest, domainName, true,
                     principalDomain, caller);
 
         } else if (tokenRequest.isRolesScope()) {

diff --git a/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplTest.java b/servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplTest.java
@@ -13488,8 +13488,8 @@ public void testGetOIDCResponseGroups() {
         List<String> userGroups = (List<String>) claims.getBody().get("groups");
         assertNotNull(userGroups);
         assertEquals(userGroups.size(), 2);
-        assertTrue(userGroups.contains("dev-team"));
-        assertTrue(userGroups.contains("pe-team"));
+        assertTrue(userGroups.contains("coretech:group.dev-team"));
+        assertTrue(userGroups.contains("coretech:group.pe-team"));
 
         // get only one of the groups and include state
 
@@ -13516,7 +13516,7 @@ public void testGetOIDCResponseGroups() {
         userGroups = (List<String>) claims.getBody().get("groups");
         assertNotNull(userGroups);
         assertEquals(userGroups.size(), 1);
-        assertTrue(userGroups.contains("dev-team"));
+        assertTrue(userGroups.contains("coretech:group.dev-team"));
 
         // requesting a group that the user is not part of