Skip to content

Commit 703c1b9

Browse files
BrandtKrugerBrandtKruger
committed
feat: Add Connection ID support across all frameworks
- Add CONNECTION_ID constant to KindeRequestParameters and KindeConstants - Implement getConnectionId() method in KindeToken interface and BaseToken - Supports direct connection_id claim - Supports nested ext_provider.connection_id structure - Add connection_id parameter support to authorizationUrlWithParameters() - Update J2EE filter and servlet to read connection_id from request parameters - Works with LOGIN, REGISTER, and CREATE_ORG actions - Add comprehensive test coverage: - ConnectionIdTest: 5 tests for authorization URL generation - ConnectionIdTokenTest: 8 tests for token extraction - ConnectionIdFilterTest: J2EE filter integration tests - Add JWT generator helpers for testing connection_id claims This implementation enables: - Passing connection_id when generating authorization URLs for social/enterprise login - Extracting connection_id from tokens (both direct and nested structures) - Automatic connection_id support in J2EE via request parameters - Core support available for SpringBoot (requires Spring Security config) All changes are backward compatible and optional.
1 parent 81082af commit 703c1b9

10 files changed

Lines changed: 621 additions & 10 deletions

File tree

‎kinde-core/src/main/java/com/kinde/constants/KindeConstants.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@ public class KindeConstants {
77
public final static String ORG_CODE = "org_code";
88
public final static String LANG = "lang";
99
public final static String ORG_NAME = "org_name";
10+
public final static String CONNECTION_ID = "connection_id";
1011
public final static String SCOPE = "openid,email,profile";
1112
}

‎kinde-core/src/main/java/com/kinde/session/KindeRequestParameters.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@ public class KindeRequestParameters {
55
public final static String HAS_SUCCESS_PAGE = "has_success_page";
66
public final static String LANG = "lang";
77
public final static String ORG_CODE = "org_code";
8+
public final static String CONNECTION_ID = "connection_id";
89
}

‎kinde-core/src/main/java/com/kinde/token/BaseToken.java‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
package com.kinde.token;
22

3-
import com.google.inject.Inject;
43
import com.kinde.accounts.KindeAccountsClient;
54
import com.kinde.accounts.dto.PermissionDto;
65
import com.kinde.accounts.dto.RoleDto;
@@ -91,6 +90,33 @@ public Object getClaim(String key) {
9190
return this.signedJWT.getJWTClaimsSet().getClaim(key);
9291
}
9392

93+
@Override
94+
@SneakyThrows
95+
public String getConnectionId() {
96+
if (this.signedJWT == null) {
97+
return null;
98+
}
99+
100+
// First, try direct connection_id claim
101+
Object connectionId = getClaim("connection_id");
102+
if (connectionId instanceof String) {
103+
return (String) connectionId;
104+
}
105+
106+
// Then, try nested ext_provider.connection_id structure
107+
Object extProvider = getClaim("ext_provider");
108+
if (extProvider instanceof Map) {
109+
@SuppressWarnings("unchecked")
110+
Map<String, Object> extProviderMap = (Map<String, Object>) extProvider;
111+
Object nestedConnectionId = extProviderMap.get("connection_id");
112+
if (nestedConnectionId instanceof String) {
113+
return (String) nestedConnectionId;
114+
}
115+
}
116+
117+
return null;
118+
}
119+
94120
@SuppressWarnings("unchecked")
95121
@Override
96122
public List<String> getPermissions() {

‎kinde-core/src/main/java/com/kinde/token/KindeToken.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,17 @@ public interface KindeToken {
1717

1818
Object getClaim(String key);
1919

20+
/**
21+
* Gets the connection ID from the token.
22+
* This method checks for connection_id in the token claims, including nested structures
23+
* like ext_provider.connection_id for external identity providers.
24+
*
25+
* @return The connection ID string, or null if not found
26+
*/
27+
default String getConnectionId() {
28+
return null;
29+
}
30+
2031
List<String> getPermissions();
2132

2233
/**

‎kinde-core/src/test/java/com/kinde/session/ConnectionIdTest.java‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
package com.kinde.session;
2+
3+
import com.kinde.KindeClient;
4+
import com.kinde.KindeClientBuilder;
5+
import com.kinde.KindeClientSession;
6+
import com.kinde.authorization.AuthorizationType;
7+
import com.kinde.authorization.AuthorizationUrl;
8+
import com.kinde.client.KindeCoreGuiceTestModule;
9+
import com.kinde.guice.KindeEnvironmentSingleton;
10+
import com.kinde.guice.KindeGuiceSingleton;
11+
import com.kinde.token.KindeTokenGuiceTestModule;
12+
import org.junit.jupiter.api.BeforeEach;
13+
import org.junit.jupiter.api.DisplayName;
14+
import org.junit.jupiter.api.Test;
15+
16+
import java.util.HashMap;
17+
import java.util.Map;
18+
19+
import static org.junit.jupiter.api.Assertions.*;
20+
21+
public class ConnectionIdTest {
22+
23+
@BeforeEach
24+
public void setUp() {
25+
KindeGuiceSingleton.fin();
26+
KindeEnvironmentSingleton.fin();
27+
KindeEnvironmentSingleton.init(KindeEnvironmentSingleton.State.ACTIVE);
28+
29+
KindeGuiceSingleton.init(
30+
new KindeCoreGuiceTestModule(),
31+
new KindeTokenGuiceTestModule());
32+
}
33+
34+
@Test
35+
@DisplayName("authorizationUrlWithParameters should include connection_id when provided")
36+
public void testAuthorizationUrlWithConnectionId() {
37+
KindeClient kindeClient = KindeClientBuilder.builder()
38+
.domain("http://localhost:8089")
39+
.clientId("test")
40+
.clientSecret("test")
41+
.redirectUri("http://localhost:8080/")
42+
.build();
43+
44+
KindeClientSession kindeClientSession = kindeClient.initClientSession("test", null);
45+
46+
Map<String, String> parameters = new HashMap<>();
47+
parameters.put(KindeRequestParameters.CONNECTION_ID, "conn_123456789");
48+
49+
AuthorizationUrl authorizationUrl = kindeClientSession.authorizationUrlWithParameters(parameters);
50+
51+
assertNotNull(authorizationUrl);
52+
assertNotNull(authorizationUrl.getUrl());
53+
String urlString = authorizationUrl.getUrl().toString();
54+
assertTrue(urlString.contains("connection_id=conn_123456789"),
55+
"URL should contain connection_id parameter. URL: " + urlString);
56+
}
57+
58+
@Test
59+
@DisplayName("login should support connection_id via authorizationUrlWithParameters")
60+
public void testLoginWithConnectionId() {
61+
KindeClient kindeClient = KindeClientBuilder.builder()
62+
.domain("http://localhost:8089")
63+
.clientId("test")
64+
.clientSecret("test")
65+
.redirectUri("http://localhost:8080/")
66+
.build();
67+
68+
KindeClientSession kindeClientSession = kindeClient.initClientSession("test", null);
69+
70+
Map<String, String> parameters = new HashMap<>();
71+
parameters.put("supports_reauth", "true");
72+
parameters.put(KindeRequestParameters.CONNECTION_ID, "conn_social_google");
73+
74+
AuthorizationUrl authorizationUrl = kindeClientSession.authorizationUrlWithParameters(parameters);
75+
76+
assertNotNull(authorizationUrl);
77+
assertNotNull(authorizationUrl.getUrl());
78+
String urlString = authorizationUrl.getUrl().toString();
79+
assertTrue(urlString.contains("connection_id=conn_social_google"),
80+
"URL should contain connection_id parameter. URL: " + urlString);
81+
assertTrue(urlString.contains("supports_reauth=true"),
82+
"URL should contain supports_reauth parameter. URL: " + urlString);
83+
}
84+
85+
@Test
86+
@DisplayName("register should support connection_id via authorizationUrlWithParameters")
87+
public void testRegisterWithConnectionId() {
88+
KindeClient kindeClient = KindeClientBuilder.builder()
89+
.domain("http://localhost:8089")
90+
.clientId("test")
91+
.clientSecret("test")
92+
.redirectUri("http://localhost:8080/")
93+
.build();
94+
95+
KindeClientSession kindeClientSession = kindeClient.initClientSession("test", null);
96+
97+
Map<String, String> parameters = new HashMap<>();
98+
parameters.put("prompt", "create");
99+
parameters.put(KindeRequestParameters.CONNECTION_ID, "conn_enterprise_saml");
100+
101+
AuthorizationUrl authorizationUrl = kindeClientSession.authorizationUrlWithParameters(parameters);
102+
103+
assertNotNull(authorizationUrl);
104+
assertNotNull(authorizationUrl.getUrl());
105+
String urlString = authorizationUrl.getUrl().toString();
106+
assertTrue(urlString.contains("connection_id=conn_enterprise_saml"),
107+
"URL should contain connection_id parameter. URL: " + urlString);
108+
assertTrue(urlString.contains("prompt=create"),
109+
"URL should contain prompt parameter. URL: " + urlString);
110+
}
111+
112+
@Test
113+
@DisplayName("connection_id should work with CODE grant type")
114+
public void testConnectionIdWithCodeGrant() {
115+
KindeClient kindeClient = KindeClientBuilder.builder()
116+
.domain("http://localhost:8089")
117+
.clientId("test")
118+
.clientSecret("test")
119+
.redirectUri("http://localhost:8080/")
120+
.grantType(AuthorizationType.CODE)
121+
.build();
122+
123+
KindeClientSession kindeClientSession = kindeClient.initClientSession("test", null);
124+
125+
Map<String, String> parameters = new HashMap<>();
126+
parameters.put(KindeRequestParameters.CONNECTION_ID, "conn_123456789");
127+
128+
AuthorizationUrl authorizationUrl = kindeClientSession.authorizationUrlWithParameters(parameters);
129+
130+
assertNotNull(authorizationUrl);
131+
assertNotNull(authorizationUrl.getUrl());
132+
assertNotNull(authorizationUrl.getCodeVerifier(), "Code verifier should be present for CODE grant type");
133+
String urlString = authorizationUrl.getUrl().toString();
134+
assertTrue(urlString.contains("connection_id=conn_123456789"),
135+
"URL should contain connection_id parameter. URL: " + urlString);
136+
}
137+
138+
@Test
139+
@DisplayName("connection_id should work with other parameters like org_code and lang")
140+
public void testConnectionIdWithOtherParameters() {
141+
KindeClient kindeClient = KindeClientBuilder.builder()
142+
.domain("http://localhost:8089")
143+
.clientId("test")
144+
.clientSecret("test")
145+
.redirectUri("http://localhost:8080/")
146+
.orgCode("ORG123")
147+
.lang("en")
148+
.build();
149+
150+
KindeClientSession kindeClientSession = kindeClient.initClientSession("test", null);
151+
152+
Map<String, String> parameters = new HashMap<>();
153+
parameters.put(KindeRequestParameters.CONNECTION_ID, "conn_123456789");
154+
155+
AuthorizationUrl authorizationUrl = kindeClientSession.authorizationUrlWithParameters(parameters);
156+
157+
assertNotNull(authorizationUrl);
158+
assertNotNull(authorizationUrl.getUrl());
159+
String urlString = authorizationUrl.getUrl().toString();
160+
assertTrue(urlString.contains("connection_id=conn_123456789"),
161+
"URL should contain connection_id parameter. URL: " + urlString);
162+
assertTrue(urlString.contains("org_code=ORG123"),
163+
"URL should contain org_code parameter. URL: " + urlString);
164+
assertTrue(urlString.contains("lang=en"),
165+
"URL should contain lang parameter. URL: " + urlString);
166+
}
167+
}

‎kinde-core/src/test/java/com/kinde/token/ConnectionIdTokenTest.java‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
package com.kinde.token;
2+
3+
import com.kinde.token.jwt.JwtGenerator;
4+
import org.junit.jupiter.api.DisplayName;
5+
import org.junit.jupiter.api.Test;
6+
7+
import static org.junit.jupiter.api.Assertions.*;
8+
9+
public class ConnectionIdTokenTest {
10+
11+
@Test
12+
@DisplayName("getConnectionId should return connection_id from token when present as direct claim")
13+
public void testGetConnectionIdDirectClaim() throws Exception {
14+
String connectionId = "conn_123456789";
15+
String tokenString = JwtGenerator.generateIDTokenWithConnectionId(connectionId);
16+
17+
KindeToken kindeToken = IDToken.init(tokenString, true);
18+
19+
assertNotNull(kindeToken);
20+
assertTrue(kindeToken.valid());
21+
assertEquals(connectionId, kindeToken.getConnectionId(),
22+
"getConnectionId() should return the connection_id from the token");
23+
}
24+
25+
@Test
26+
@DisplayName("getConnectionId should return connection_id from ext_provider nested structure")
27+
public void testGetConnectionIdFromExtProvider() throws Exception {
28+
String connectionId = "conn_enterprise_saml_789";
29+
String tokenString = JwtGenerator.generateIDTokenWithExtProviderConnectionId(connectionId);
30+
31+
KindeToken kindeToken = IDToken.init(tokenString, true);
32+
33+
assertNotNull(kindeToken);
34+
assertTrue(kindeToken.valid());
35+
assertEquals(connectionId, kindeToken.getConnectionId(),
36+
"getConnectionId() should return the connection_id from ext_provider.connection_id");
37+
}
38+
39+
@Test
40+
@DisplayName("getConnectionId should return null when connection_id is not present")
41+
public void testGetConnectionIdWhenNotPresent() throws Exception {
42+
String tokenString = JwtGenerator.generateIDToken();
43+
44+
KindeToken kindeToken = IDToken.init(tokenString, true);
45+
46+
assertNotNull(kindeToken);
47+
assertTrue(kindeToken.valid());
48+
assertNull(kindeToken.getConnectionId(),
49+
"getConnectionId() should return null when connection_id is not in the token");
50+
}
51+
52+
@Test
53+
@DisplayName("getConnectionId should prefer direct connection_id over nested ext_provider.connection_id")
54+
public void testGetConnectionIdPreferDirectOverNested() throws Exception {
55+
// Create a token with direct connection_id
56+
String directConnectionId = "conn_direct_123";
57+
58+
// For this test, we'll use the direct one and verify it's preferred
59+
String tokenString = JwtGenerator.generateIDTokenWithConnectionId(directConnectionId);
60+
61+
KindeToken kindeToken = IDToken.init(tokenString, true);
62+
63+
assertNotNull(kindeToken);
64+
assertTrue(kindeToken.valid());
65+
assertEquals(directConnectionId, kindeToken.getConnectionId(),
66+
"getConnectionId() should prefer direct connection_id claim");
67+
}
68+
69+
@Test
70+
@DisplayName("getConnectionId should work with AccessToken")
71+
public void testGetConnectionIdWithAccessToken() throws Exception {
72+
String connectionId = "conn_access_token_123";
73+
String tokenString = JwtGenerator.generateIDTokenWithConnectionId(connectionId);
74+
75+
// AccessToken uses the same BaseToken implementation
76+
KindeToken kindeToken = AccessToken.init(tokenString, true);
77+
78+
assertNotNull(kindeToken);
79+
assertTrue(kindeToken.valid());
80+
assertEquals(connectionId, kindeToken.getConnectionId(),
81+
"getConnectionId() should work with AccessToken");
82+
}
83+
84+
@Test
85+
@DisplayName("getConnectionId should return null for invalid token")
86+
public void testGetConnectionIdWithInvalidToken() throws Exception {
87+
String tokenString = "invalid.token.string";
88+
89+
KindeToken kindeToken = IDToken.init(tokenString, false);
90+
91+
assertNotNull(kindeToken);
92+
assertFalse(kindeToken.valid());
93+
assertNull(kindeToken.getConnectionId(),
94+
"getConnectionId() should return null for invalid tokens");
95+
}
96+
97+
@Test
98+
@DisplayName("getConnectionId should handle null ext_provider gracefully")
99+
public void testGetConnectionIdWithNullExtProvider() throws Exception {
100+
// Token without ext_provider should work fine
101+
String tokenString = JwtGenerator.generateIDToken();
102+
103+
KindeToken kindeToken = IDToken.init(tokenString, true);
104+
105+
assertNotNull(kindeToken);
106+
assertTrue(kindeToken.valid());
107+
assertNull(kindeToken.getConnectionId(),
108+
"getConnectionId() should handle missing ext_provider gracefully");
109+
}
110+
111+
@Test
112+
@DisplayName("getConnectionId should handle ext_provider without connection_id gracefully")
113+
public void testGetConnectionIdWithExtProviderButNoConnectionId() throws Exception {
114+
// This test verifies that if ext_provider exists but doesn't have connection_id, it returns null
115+
// We'll use a regular token and verify the behavior
116+
String tokenString = JwtGenerator.generateIDToken();
117+
118+
KindeToken kindeToken = IDToken.init(tokenString, true);
119+
120+
assertNotNull(kindeToken);
121+
assertTrue(kindeToken.valid());
122+
assertNull(kindeToken.getConnectionId(),
123+
"getConnectionId() should return null when ext_provider exists but has no connection_id");
124+
}
125+
}

0 commit comments

Comments
 (0)