From 2479a49e1bdfddb4970f061d383fe2cc493e83fb Mon Sep 17 00:00:00 2001
From: Fayez Ahmed <fayez.ahmed1@nhs.net>
Date: Tue, 18 Jun 2024 13:51:24 +0100
Subject: [PATCH 1/2] APM-5267: Add identity_proofing_level to policy

---
 proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml   | 1 +
 .../OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml b/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml
index 9ff7fc4d..0fdbb50e 100644
--- a/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml
+++ b/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml
@@ -19,6 +19,7 @@
         <Attribute name="id_token-acr" ref="jwt.DecodeJWT.FromExternalIdToken.claim.acr" display="true"/>
         <Attribute name="id_token-amr" ref="jwt.DecodeJWT.FromExternalIdToken.claim.amr" display="true"/>
         <Attribute name="id_token-id-assurance-level" ref="jwt.DecodeJWT.FromExternalIdToken.claim.id_assurance_level" display="true"/>
+        <Attribute name="id_token-identity-proofing-level" ref="jwt.DecodeJWT.FromExternalIdToken.decoded.claim.identity_proofing_level" display="true"/>
         <Attribute name="auth_type" ref="splunk.auth.type" display="true"/>
         <Attribute name="auth_grant_type" ref="splunk.auth.grant_type" display="true"/>
         <Attribute name="auth_provider" ref="splunk.auth.provider" display="true"/>
diff --git a/proxies/live/apiproxy/policies/OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml b/proxies/live/apiproxy/policies/OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml
index 6d497719..add20e0a 100644
--- a/proxies/live/apiproxy/policies/OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml
+++ b/proxies/live/apiproxy/policies/OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml
@@ -24,6 +24,7 @@
         <Attribute name="id_token-acr" ref="jwt.VerifyJWT.SubjectToken.claim.acr" display="true" />
         <Attribute name="id_token-amr" ref="jwt.VerifyJWT.SubjectToken.claim.amr" display="true" />
         <Attribute name="id_token-id-assurance-level" ref="jwt.VerifyJWT.SubjectToken.claim.id_assurance_level" display="true" />
+        <Attribute name="id_token-identity-proofing-level" ref="jwt.VerifyJWT.SubjectToken.claim.identity_proofing_level" display="true"/>
         <Attribute name="grant_type" display="true">urn:ietf:params:oauth:grant-type:token-exchange</Attribute>
         <Attribute name="auth_type" ref="splunk.auth.type" display="true" />
         <Attribute name="auth_grant_type" ref="splunk.auth.grant_type" display="true" />

From 15a054f5b6c4ee0705925ccaf4894aa6d535a582 Mon Sep 17 00:00:00 2001
From: Fayez Ahmed <fayez.ahmed1@nhs.net>
Date: Tue, 18 Jun 2024 13:53:04 +0100
Subject: [PATCH 2/2] APM-5256: Fix reference to variable

---
 proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml b/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml
index 0fdbb50e..68c6df6b 100644
--- a/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml
+++ b/proxies/live/apiproxy/policies/OAuthV2.GenerateAccessToken.xml
@@ -19,7 +19,7 @@
         <Attribute name="id_token-acr" ref="jwt.DecodeJWT.FromExternalIdToken.claim.acr" display="true"/>
         <Attribute name="id_token-amr" ref="jwt.DecodeJWT.FromExternalIdToken.claim.amr" display="true"/>
         <Attribute name="id_token-id-assurance-level" ref="jwt.DecodeJWT.FromExternalIdToken.claim.id_assurance_level" display="true"/>
-        <Attribute name="id_token-identity-proofing-level" ref="jwt.DecodeJWT.FromExternalIdToken.decoded.claim.identity_proofing_level" display="true"/>
+        <Attribute name="id_token-identity-proofing-level" ref="jwt.DecodeJWT.FromExternalIdToken.claim.identity_proofing_level" display="true"/>
         <Attribute name="auth_type" ref="splunk.auth.type" display="true"/>
         <Attribute name="auth_grant_type" ref="splunk.auth.grant_type" display="true"/>
         <Attribute name="auth_provider" ref="splunk.auth.provider" display="true"/>