Merge pull request #380 from NHSDigital/APM-5380-token-exchange-flow-…

…vars APM-5380 try to get the token exchange flow vars from the subject token
NHSDigital · Jun 12, 2024 · b406395 · b406395
2 parents 97de85c + a5c93e3
commit b406395
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/e2e/tests/conftest.py b/e2e/tests/conftest.py
@@ -103,6 +103,7 @@ def cis2_subject_token_claims():
         "aud": "969567331415.apps.national",
         "c_hash": "bc7zzGkClC3MEiFQ3YhPKg",
         "acr": "AAL3_ANY",
+        "id_assurance_level": int(3),
         "org.forgerock.openidconnect.ops": "-I45NjmMDdMa-aNF2sr9hC7qEGQ",
         "s_hash": "LPJNul-wow4m6Dsqxbning",
         "azp": "969567331415.apps.national",

diff --git a/proxies/live/apiproxy/policies/OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml b/proxies/live/apiproxy/policies/OAuthV2.TokenExchangeGenerateAccessTokenFilteredScopes.xml
@@ -21,9 +21,9 @@
         <Attribute name="id_token-subject" ref="jwt.VerifyJWT.SubjectToken.claim.subject" display="true" />
         <Attribute name="id_token" display="true" ref="request.formparam.subject_token" />
         <Attribute name="id_token-issuer" ref="jwt.VerifyJWT.SubjectToken.claim.issuer" display="true" />
-        <Attribute name="id_token-acr" ref="jwt.DecodeJWT.FromExternalIdToken.claim.acr" display="true" />
-        <Attribute name="id_token-amr" ref="jwt.DecodeJWT.FromExternalIdToken.claim.amr" display="true" />
-        <Attribute name="id_token-id-assurance-level" ref="jwt.DecodeJWT.FromExternalIdToken.claim.id_assurance_level" display="true" />
+        <Attribute name="id_token-acr" ref="jwt.VerifyJWT.SubjectToken.claim.acr" display="true" />
+        <Attribute name="id_token-amr" ref="jwt.VerifyJWT.SubjectToken.claim.amr" display="true" />
+        <Attribute name="id_token-id-assurance-level" ref="jwt.VerifyJWT.SubjectToken.claim.id_assurance_level" display="true" />
         <Attribute name="grant_type" display="true">urn:ietf:params:oauth:grant-type:token-exchange</Attribute>
         <Attribute name="auth_type" ref="splunk.auth.type" display="true" />
         <Attribute name="auth_grant_type" ref="splunk.auth.grant_type" display="true" />