Add normalizedRequestURI and authorizedScopes to the thread local

components/org.wso2.carbon.identity.auth.service/src/main/java/org/wso2/carbon/identity/auth/service/handler/impl/OAuth2AccessTokenHandler.java

@@ -212,6 +212,10 @@
                 authenticationContext.addParameter(Constants.OAUTH2_VALIDATE_SCOPE,
                         AuthConfigurationUtil.getInstance().isScopeValidationEnabled());
 
+                // Set the allowed scopes to the thread local to be used down the flow.
+                IdentityUtil.threadLocalProperties.get().put(Constants.AUTHORIZED_SCOPES,
+                        Arrays.asList(OAuth2Util.buildScopeArray(oAuth2IntrospectionResponseDTO.getScope())));
+
                 ServiceProvider serviceProvider = null;
                 String serviceProviderName = null;
                 String serviceProviderUUID = null;

components/org.wso2.carbon.identity.auth.service/src/main/java/org/wso2/carbon/identity/auth/service/util/Constants.java

@@ -14,6 +14,7 @@ public class Constants {
     public final static String RESOURCE_SCOPE_ELE = "Scopes";
     public final static String OAUTH2_ALLOWED_SCOPES = "oauth2-allowed-scopes";
     public final static String OAUTH2_VALIDATE_SCOPE = "oauth2-validate-scopes";
+    public static final String AUTHORIZED_SCOPES = "authorizedScopes";
     public final static String RESOURCE_CROSS_TENANT_ATTR = "cross-tenant";
     public final static String RESOURCE_CROSS_ACCESS_ALLOWED_TENANTS = "cross-access-allowed-tenants";
     public final static String RESOURCE_ALLOWED_AUTH_HANDLERS = "allowed-auth-handlers";

components/org.wso2.carbon.identity.auth.valve/src/main/java/org/wso2/carbon/identity/auth/valve/AuthenticationValve.java

@@ -81,6 +81,7 @@ public class AuthenticationValve extends ValveBase {
     private static final String AUTH_CONTEXT = "auth-context";
     private static final String USER_AGENT = "User-Agent";
     private static final String REMOTE_ADDRESS = "remoteAddress";
+    private static final String NORMALIZED_REQUEST_URI = "normalizedRequestURI";
     private static final String SERVICE_PROVIDER_NAME = "serviceProvider";
     private static final String IMPERSONATOR = "impersonator";
     private static final String SERVICE_PROVIDER_UUID= "serviceProviderUUID";
@@ -112,6 +113,8 @@ public void invoke(Request request, Response response) throws IOException, Servl
         try {
             validateRequestURI(request.getRequestURI());
             String normalizedRequestURI = AuthConfigurationUtil.getInstance().getNormalizedRequestURI(request.getRequestURI());
+            //add normalized request URI to thread local property
+            setThreadLocalNormalizedRequestURI(normalizedRequestURI);
             ResourceConfig securedResource = authenticationManager.getSecuredResource(
                     new ResourceConfigKey(normalizedRequestURI, request.getMethod()));
 
@@ -208,9 +211,12 @@ public void invoke(Request request, Response response) throws IOException, Servl
             unsetAuthenticatedWithBasicAuth();
             // Clear thread local authentication type.
             unsetThreadLocalAuthenticationType();
+            // Clear thread local AUTHORIZED_SCOPES.
+            unsetAuthorizedScopesThreadLocal();
+            // Clear thread local NORMALIZED_REQUEST_URI.
+            unsetThreadLocalNormalizedRequestURI();
         }
 
-
     }
 
     /**
@@ -283,6 +289,22 @@ private void unsetThreadLocalServiceProvider() {
         IdentityUtil.threadLocalProperties.get().remove(SERVICE_PROVIDER_UUID);
     }
 
+    private void setThreadLocalNormalizedRequestURI(String normalizedRequestURI) {
+
+        if (StringUtils.isNotBlank(normalizedRequestURI)) {
+            IdentityUtil.threadLocalProperties.get().put(NORMALIZED_REQUEST_URI, normalizedRequestURI);
+        } else if (log.isDebugEnabled()) {
+            log.debug("Normalized request URI is not available to add to thread local property " + NORMALIZED_REQUEST_URI);
+        }
+    }
+
+    private void unsetThreadLocalNormalizedRequestURI() {
+
+        if (IdentityUtil.threadLocalProperties.get().get(NORMALIZED_REQUEST_URI) != null) {
+            IdentityUtil.threadLocalProperties.get().remove(NORMALIZED_REQUEST_URI);
+        }
+    }
+
     private void unsetThreadLocalAuthenticationType() {
 
             IdentityUtil.threadLocalProperties.get().remove(Constants.AUTHENTICATION_TYPE);
@@ -368,6 +390,13 @@ private void unsetCurrentTokenIdThreadLocal() {
         }
     }
 
+    private void unsetAuthorizedScopesThreadLocal() {
+
+        if (IdentityUtil.threadLocalProperties.get().get(Constants.AUTHORIZED_SCOPES) != null) {
+            IdentityUtil.threadLocalProperties.get().remove(Constants.AUTHORIZED_SCOPES);
+        }
+    }
+
     private boolean validateTenantDomain(Request request, Response response, String tenantDomain)
             throws IOException, ServletException {
 

components/org.wso2.carbon.identity.authz.service/src/main/java/org/wso2/carbon/identity/authz/service/handler/AuthorizationHandler.java

@@ -170,17 +170,13 @@ private void validatePermissions(AuthorizationResult authorizationResult, User u
 
     private void validateScopes(AuthorizationContext authorizationContext, AuthorizationResult authorizationResult, String[] allowedScopes) {
 
-        boolean granted = true;
         if (allowedScopes != null) {
-            for (String scope : authorizationContext.getRequiredScopes()) {
-                if (!ArrayUtils.contains(allowedScopes, scope)) {
-                    granted = false;
-                    break;
+            for (String requiredScope : authorizationContext.getRequiredScopes()) {
+                if (ArrayUtils.contains(allowedScopes, requiredScope)) {
+                    authorizationResult.setAuthorizationStatus(AuthorizationStatus.GRANT);
+                    return;
                 }
             }
-            if (granted) {
-                authorizationResult.setAuthorizationStatus(AuthorizationStatus.GRANT);
-            }
         }
     }