Add realmName and realmIdentifier attributes to mpJwt element by wrodrig · Pull Request #35738 · OpenLiberty/open-liberty

wrodrig · 2026-09-09T20:19:05Z

Adds two new configuration attributes to the MicroProfile JWT element to give operators control over realm resolution:

realmName - static string; when set, always used as the realm
realmIdentifier - JWT claim name to read the realm from (default: "realm")

Resolution order mirrors openidConnectClient behaviour:

realmName (if non-empty)
claim named by realmIdentifier
iss fallback

Fixes a customer issue (TS022732550) where an IdP issues tokens with "realm": "/idbroker" (slash-prefixed). The slash caused AccessIdUtil.matcher() to return null, which broke authentication. Setting realmName="myapp" in bypasses the problematic claim entirely and authentication succeeds.

Components changed:
com.ibm.ws.security.mp.jwt - metatype, config interface/impl,
JwtPrincipalMapping, TAIMappingHelper,
unit tests
com.ibm.ws.security.jwtsso - stub getters in JwtSsoComponent
com.ibm.ws.security.mp.jwt.1.1_fat - MPJwtRealmConfigTests + 4 server
configs + FATSuite registration"

I have considered the risk of behavior change or other zero migration impact (https://github.com/OpenLiberty/open-liberty/wiki/Behavior-Changes).
If this PR fixes an Issue, the description includes "Fixes #FILLMEIN" or "Resolves #FILLMEIN" (verify release bug label if applicable: https://github.com/OpenLiberty/open-liberty/wiki/Open-Liberty-Conventions).
If this PR resolves an external Known Issue (including APARS), the description includes "Fixes #FILLMEIN" or "Resolves #FILLMEIN".

wrodrig · 2026-09-09T20:24:03Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
fat.buckets.to.run=all
spawn.fullfat.buckets=com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1.sysProps,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.2,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.2.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.2.sysProps,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.0,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.0.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.0.sysProps,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1.sysProps,com.ibm.ws.security.jwtsso_fat.mpJwt-1.1,com.ibm.ws.security.jwtsso_fat.mpJwt-1.2,com.ibm.ws.security.jwtsso_fat.mpJwt-2.0,com.ibm.ws.security.jwtsso_fat.mpJwt-2.1,com.ibm.ws.security.jwtsso_fat.noMpJwt,com.ibm.ws.security.token.ltpa_fat

Note: Target locations of links might be accessible only to IBM employees.

wrodrig · 2026-09-09T20:24:18Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
fat.buckets.to.run=all
fat.test.mode=full

Note: Target locations of links might be accessible only to IBM employees.

LibbyBot · 2026-09-09T20:34:39Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2026-09-09T20:40:20Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

…element Adds two new configuration attributes to the MicroProfile JWT <mpJwt> element to give operators control over realm resolution: realmName - static string; when set, always used as the realm realmIdentifier - JWT claim name to read the realm from (default: \"realm\") Resolution order mirrors openidConnectClient behaviour: 1. realmName (if non-empty) 2. claim named by realmIdentifier 3. iss fallback Fixes a customer issue (TS022732550) where an IdP issues tokens with \"realm\": \"/idbroker\" (slash-prefixed). The slash caused AccessIdUtil.matcher() to return null, which broke authentication. Setting realmName=\"myapp\" in <mpJwt> bypasses the problematic claim entirely and authentication succeeds. Components changed: com.ibm.ws.security.mp.jwt - metatype, config interface/impl, JwtPrincipalMapping, TAIMappingHelper, unit tests com.ibm.ws.security.jwtsso - stub getters in JwtSsoComponent com.ibm.ws.security.mp.jwt.1.1_fat - MPJwtRealmConfigTests + 4 server configs + FATSuite registration"

wrodrig · 2026-09-09T21:34:52Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
fat.buckets.to.run=all
spawn.fullfat.buckets=com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1.sysProps,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.2,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.2.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.2.sysProps,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.0,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.0.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.0.sysProps,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1.envVars,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1.sysProps,com.ibm.ws.security.jwtsso_fat.mpJwt-1.1,com.ibm.ws.security.jwtsso_fat.mpJwt-1.2,com.ibm.ws.security.jwtsso_fat.mpJwt-2.0,com.ibm.ws.security.jwtsso_fat.mpJwt-2.1,com.ibm.ws.security.jwtsso_fat.noMpJwt,com.ibm.ws.security.token.ltpa_fat

Note: Target locations of links might be accessible only to IBM employees.

wrodrig · 2026-09-09T21:35:07Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
fat.buckets.to.run=all
fat.test.mode=full

Note: Target locations of links might be accessible only to IBM employees.

wrodrig · 2026-09-09T21:40:19Z

Fixes #35741

LibbyBot · 2026-09-09T21:44:21Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2026-09-09T21:45:23Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

jantley-ibm

Minor ID review comment attached. I will add the "ID reviewed" label when we agree on edits. Let me know if you have any questions or concerns. Thanks!

- Remove the redundant 4-arg JwtPrincipalMapping constructor; update the only call site (TAIMappingHelper no-config constructor) to pass "realm" explicitly to the 5-arg constructor instead of relying on the null fallback path. - Gate setRealm() on mapToUserRegistry, matching the openidConnectClient pattern in AttributeToSubject. When mapToUserRegistry is true, realm resolution (realmName, realmIdentifier, iss fallback) is skipped entirely since the user registry provides the identity. - Align metatype.properties NLS strings for realmIdentifier and realmName with the openidConnectClient equivalents, substituting "JWT token" for "ID token" and "mapToUserRegistry" for "mapIdentityToRegistryUser". Add the "do not translate mapToUserRegistry" translator hint.

wrodrig · 2026-09-10T18:04:30Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
fat.buckets.to.run=all
fat.test.mode=full

Note: Target locations of links might be accessible only to IBM employees.

wrodrig · 2026-09-10T18:05:51Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
(view Open Liberty Personal Build - ⏳InProgress)
fat.buckets.to.run=all
spawn.fullfat.buckets=com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1

Note: Target locations of links might be accessible only to IBM employees.

LibbyBot · 2026-09-10T18:13:15Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

LibbyBot · 2026-09-10T18:15:21Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

- metatype.properties: clarify realmName.desc to state it overrides the realm claim in the token - JwtPrincipalMapping: move null-check/REALM_CLAIM fallback into getRealm() and drop unnecessary isEmpty() guard on realmIdentifierAttr - TAIMappingHelper: simplify setRealm() by eliminating duplicate getMappedRealm() call; add Javadoc describing realm resolution priority

wrodrig · 2026-09-17T23:15:55Z

!build
(view Open Liberty Personal Build - ❌ completed with errors/failures.)
fat.buckets.to.run=all
spawn.fullfat.buckets=com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-1.1,com.ibm.ws.security.mp.jwt.1.1_fat.mpJwt-2.1

Note: Target locations of links might be accessible only to IBM employees.

LibbyBot · 2026-09-17T23:22:52Z

Code analysis and actions

DO NOT DELETE THIS COMMENT.

1 FAT files were changed, added, or removed.
Check that the build did not break the affected FAT suite(s).
5 test infrastructure code files were changed.
Test failures/errors in the build could be due to these changes.
7 product code files were changed.
Please describe in a separate comment how you tested your changes.
1 NLS files were changed and need an ID review.
@OpenLiberty/message-reviewer Please review.
- dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties

wrodrig self-assigned this Sep 9, 2026

wrodrig changed the title ~~git commit -m "Add realmName and realmIdentifier attributes to mpJwt …~~ Add realmName and realmIdentifier attributes to mpJwt element Sep 9, 2026

LibbyBot added the CLA Signed label Sep 9, 2026

wrodrig force-pushed the add-mpjwt-realm-overwrite branch from 5a230b6 to 5445ead Compare September 9, 2026 20:39

wrodrig force-pushed the add-mpjwt-realm-overwrite branch from 5445ead to 97ef88c Compare September 9, 2026 21:32

wrodrig requested a review from jimmy1wu September 9, 2026 21:34

jantley-ibm reviewed Sep 10, 2026

View reviewed changes

Comment thread dev/com.ibm.ws.security.mp.jwt/resources/OSGI-INF/l10n/metatype.properties Outdated

wrodrig force-pushed the add-mpjwt-realm-overwrite branch 2 times, most recently from 36fd84d to 79bb402 Compare September 10, 2026 18:02

wrodrig force-pushed the add-mpjwt-realm-overwrite branch from 79bb402 to ffb3a3b Compare September 10, 2026 18:03

jantley-ibm added the ID reviewed label Sep 10, 2026

wrodrig requested a review from jantley-ibm September 14, 2026 15:19

wrodrig requested review from arkarkala and utle September 17, 2026 23:15

Conversation

wrodrig commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wrodrig commented Sep 9, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wrodrig commented Sep 9, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Sep 9, 2026

Code analysis and actions

Uh oh!

LibbyBot commented Sep 9, 2026

Code analysis and actions

Uh oh!

wrodrig commented Sep 9, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wrodrig commented Sep 9, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wrodrig commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Sep 9, 2026

Code analysis and actions

Uh oh!

LibbyBot commented Sep 9, 2026

Code analysis and actions

Uh oh!

jantley-ibm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wrodrig commented Sep 10, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wrodrig commented Sep 10, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Sep 10, 2026

Code analysis and actions

Uh oh!

LibbyBot commented Sep 10, 2026

Code analysis and actions

Uh oh!

wrodrig commented Sep 17, 2026 • edited by LibbyBot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LibbyBot commented Sep 17, 2026

Code analysis and actions

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wrodrig commented Sep 9, 2026 •

edited

Loading

wrodrig commented Sep 9, 2026 •

edited by LibbyBot

Loading

wrodrig commented Sep 9, 2026 •

edited by LibbyBot

Loading

wrodrig commented Sep 9, 2026 •

edited by LibbyBot

Loading

wrodrig commented Sep 9, 2026 •

edited by LibbyBot

Loading

wrodrig commented Sep 9, 2026 •

edited

Loading

wrodrig commented Sep 10, 2026 •

edited by LibbyBot

Loading

wrodrig commented Sep 10, 2026 •

edited by LibbyBot

Loading

wrodrig commented Sep 17, 2026 •

edited by LibbyBot

Loading