Extract groups from OAuth JWT token

src/main/java/org/cbioportal/application/security/util/ClaimRoleExtractorUtil.java

@@ -2,6 +2,7 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -19,6 +20,7 @@ public static Collection<String> extractClientRoles(final Map<String, Object> cl
         try {
             // Convert the map to a JSON string
             ObjectMapper objectMapper = new ObjectMapper();
+            objectMapper.registerModule(new JavaTimeModule());
             String jsonString = objectMapper.writeValueAsString(claims);
 
             JsonNode rolesCursor = new ObjectMapper().readTree(jsonString);
@@ -51,6 +53,9 @@ public static Collection<String> extractClientRoles(final JsonNode claims, final
                 }
 
             }
+            if (rolesCursor.isTextual()) {
+                rolesCursor = new ObjectMapper().readTree(rolesCursor.asText());
+            }
             return StreamSupport.stream(rolesCursor.spliterator(), false)
                 .map(JsonNode::asText)
                 .collect(Collectors.toSet());

src/test/java/org/cbioportal/application/security/util/ClaimRoleExtractorUtilTest.java

@@ -0,0 +1,90 @@
+package org.cbioportal.application.security.util;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import org.junit.jupiter.api.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+
+
+import java.time.Instant;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+@RunWith(MockitoJUnitRunner.class)
+class ClaimRoleExtractorUtilTest {
+
+    @Test
+    void shouldExtractRolesFromSerializedClaims() {
+        String claims = """
+            {
+                "roles": ["role1", "role2"]
+            }
+            """;
+        String jwtRolesPath = "roles";
+        var result = ClaimRoleExtractorUtil.extractClientRoles(claims, jwtRolesPath);
+        assertNotNull(result);
+        assertEquals(2, result.size());
+        assertTrue(result.contains("role1"));
+        assertTrue(result.contains("role2"));
+    }
+
+    @Test
+    void shouldExtractRolesFromJsonNodeClaims() {
+        ObjectMapper objectMapper = new ObjectMapper();
+        String roleString = """
+                ["role1","role2","role3"]
+            """;
+        ObjectNode root = objectMapper.createObjectNode();
+        root.put("roles", roleString);
+        String jwtRolesPath = "roles";
+
+        var result = ClaimRoleExtractorUtil.extractClientRoles(root, jwtRolesPath);
+
+        assertNotNull(result);
+        assertEquals(3, result.size());
+        assertTrue(result.contains("role1"));
+        assertTrue(result.contains("role2"));
+        assertTrue(result.contains("role3"));
+    }
+
+    @Test
+    void shouldExtractRolesFromString() {
+        ObjectMapper objectMapper = new ObjectMapper();
+        String groupString = """
+                ["GROUP_A","GROUP_B","GROUP_C"]
+            """;
+        ObjectNode root = objectMapper.createObjectNode();
+        root.put("groups", groupString);
+        String jwtRolesPath = "groups";
+
+        var result = ClaimRoleExtractorUtil.extractClientRoles(root, jwtRolesPath);
+
+        assertNotNull(result);
+        assertEquals(3, result.size());
+        assertTrue(result.contains("GROUP_A"));
+        assertTrue(result.contains("GROUP_B"));
+        assertTrue(result.contains("GROUP_C"));
+    }
+
+    @Test
+    void shouldExtractRolesFormIdToken() {
+
+        Map<String, Object> claims = new HashMap<>();
+        claims.put("aud", "my-app-client-id");
+        claims.put("exp", Instant.now());
+        claims.put("iat", Instant.now());
+        claims.put("groups", List.of("GROUP_X", "GROUP_Y"));
+
+        String jwtRolesPath = "groups";
+        var result = ClaimRoleExtractorUtil.extractClientRoles(claims, jwtRolesPath);
+        assertNotNull(result);
+        assertEquals(2, result.size());
+        assertTrue(result.contains("GROUP_X"));
+        assertTrue(result.contains("GROUP_Y"));
+    }
+
+}