Add REST APIs for multiple client secrets and secret expiry - #1154
Open
AfraHussaindeen wants to merge 3 commits into
Open
Add REST APIs for multiple client secrets and secret expiry#1154AfraHussaindeen wants to merge 3 commits into
AfraHussaindeen wants to merge 3 commits into
Conversation
AfraHussaindeen
marked this pull request as draft
July 28, 2026 01:56
Contributor
📝 WalkthroughSummaryAdds REST APIs to manage multiple OAuth client secrets throughout their lifecycle. Changes
WalkthroughThe application management API now supports OAuth client-secret creation, listing, retrieval, and deletion. OpenAPI definitions add lifecycle endpoints, request and response schemas, scopes, validation responses, and secret metadata. REST and application services delegate operations with the OAuth client ID and tenant domain. OAuth functions invoke the client-secret service, convert DTOs, and map failures to API errors. Unauthorized responses remove secret-related metadata. OIDC configuration mappings include secret expiration and multiple-secret status. Sequence Diagram(s)sequenceDiagram
participant Client
participant ApplicationsApiServiceImpl
participant ServerApplicationManagementService
participant OAuthInboundFunctions
participant OAuthClientSecretService
Client->>ApplicationsApiServiceImpl: request client-secret operation
ApplicationsApiServiceImpl->>ServerApplicationManagementService: delegate application operation
ServerApplicationManagementService->>OAuthInboundFunctions: resolve client ID and tenant domain
OAuthInboundFunctions->>OAuthClientSecretService: create, list, retrieve, or delete secret
OAuthClientSecretService-->>OAuthInboundFunctions: return secret DTO or operation result
OAuthInboundFunctions-->>ServerApplicationManagementService: return mapped API result
ServerApplicationManagementService-->>ApplicationsApiServiceImpl: return HTTP response
ApplicationsApiServiceImpl-->>Client: return client-secret response
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
AfraHussaindeen
force-pushed
the
master_multi-secrets
branch
from
August 4, 2026 23:50
a558f66 to
4a11d64
Compare
AfraHussaindeen
marked this pull request as ready for review
August 4, 2026 23:50
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/ServerApplicationManagementService.java (1)
1883-1910: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueExtract the repeated client-ID resolution into a helper.
The four new methods repeat the same two statements.
regenerateOAuthApplicationSecretandrevokeOAuthClientrepeat them as well. A single private helper keeps the delegation methods to one line each.♻️ Proposed refactor
+ private String getOAuthClientId(String applicationId) { + + return getInboundAuthRequestConfig(applicationId, OAUTH2).getInboundAuthKey(); + } + public ClientSecretResponse createOAuthClientSecret(String applicationId, ClientSecretCreationRequest request) { - InboundAuthenticationRequestConfig oauthInbound = getInboundAuthRequestConfig(applicationId, OAUTH2); - String clientId = oauthInbound.getInboundAuthKey(); - return OAuthInboundFunctions.createClientSecret(clientId, request); + return OAuthInboundFunctions.createClientSecret(getOAuthClientId(applicationId), request); } public ClientSecretList getOAuthClientSecrets(String applicationId) { - InboundAuthenticationRequestConfig oauthInbound = getInboundAuthRequestConfig(applicationId, OAUTH2); - String clientId = oauthInbound.getInboundAuthKey(); - return OAuthInboundFunctions.getClientSecrets(clientId); + return OAuthInboundFunctions.getClientSecrets(getOAuthClientId(applicationId)); } public ClientSecretResponse getOAuthClientSecret(String applicationId, String secretId) { - InboundAuthenticationRequestConfig oauthInbound = getInboundAuthRequestConfig(applicationId, OAUTH2); - String clientId = oauthInbound.getInboundAuthKey(); - return OAuthInboundFunctions.getClientSecret(clientId, secretId); + return OAuthInboundFunctions.getClientSecret(getOAuthClientId(applicationId), secretId); } public void deleteOAuthClientSecret(String applicationId, String secretId) { - InboundAuthenticationRequestConfig oauthInbound = getInboundAuthRequestConfig(applicationId, OAUTH2); - String clientId = oauthInbound.getInboundAuthKey(); - OAuthInboundFunctions.deleteClientSecret(clientId, secretId); + OAuthInboundFunctions.deleteClientSecret(getOAuthClientId(applicationId), secretId); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/ServerApplicationManagementService.java` around lines 1883 - 1910, Extract the repeated OAUTH2 inbound client-ID lookup into a private helper in ServerApplicationManagementService, reusing the logic from createOAuthClientSecret, getOAuthClientSecrets, getOAuthClientSecret, and deleteOAuthClientSecret. Update those methods, along with regenerateOAuthApplicationSecret and revokeOAuthClient, to call the helper and retain their existing OAuthInboundFunctions delegation behavior.components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/resources/applications.yaml (1)
1303-1308: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider documenting a
Locationheader for the created secret.Other creation operations in this contract declare a
Locationheader on 201 (for example lines 99-103 and 152-156). The new secret resource is addressable at/applications/{applicationId}/inbound-protocols/oidc/secrets/{secretId}. Adding the header would align this operation with the existing convention. The implementation currently returns only the entity, so this change also requires a small update inApplicationsApiServiceImpl.createOAuthClientSecret.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/resources/applications.yaml` around lines 1303 - 1308, Document a Location header for the 201 response of the client-secret creation operation, using the addressable secret resource path under the application and secret identifiers. Update ApplicationsApiServiceImpl.createOAuthClientSecret to return that Location header along with the created entity, matching the existing creation-operation convention.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/inbound/oauth2/ApiModelToOAuthConsumerApp.java`:
- Line 71: Guard the client-secret expiry mappings against null values: in
ApiModelToOAuthConsumerApp.java:71-71, call the OAuth consumer DTO expiry setter
only when oidcModel.getClientSecretExpiresAt() is non-null; in
OAuthInboundFunctions.java:303-317, call secretRequest.setExpiryTime(...) only
when request.getExpiresAt() is non-null, while preserving the existing request
!= null guard in createClientSecret.
In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/inbound/oauth2/OAuthInboundFunctions.java`:
- Around line 354-363: The toClientSecretResponse method should not map status
via valueOf(dto.getStatus().name()). Handle a null dto.getStatus() explicitly,
then translate each supported backend status to the corresponding
ClientSecretResponse.StatusEnum through an explicit mapping or dedicated
conversion method, with defined handling for unsupported values.
---
Nitpick comments:
In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/ServerApplicationManagementService.java`:
- Around line 1883-1910: Extract the repeated OAUTH2 inbound client-ID lookup
into a private helper in ServerApplicationManagementService, reusing the logic
from createOAuthClientSecret, getOAuthClientSecrets, getOAuthClientSecret, and
deleteOAuthClientSecret. Update those methods, along with
regenerateOAuthApplicationSecret and revokeOAuthClient, to call the helper and
retain their existing OAuthInboundFunctions delegation behavior.
In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/resources/applications.yaml`:
- Around line 1303-1308: Document a Location header for the 201 response of the
client-secret creation operation, using the addressable secret resource path
under the application and secret identifiers. Update
ApplicationsApiServiceImpl.createOAuthClientSecret to return that Location
header along with the created entity, matching the existing creation-operation
convention.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9a17accb-308a-40b1-b089-6bfb3b9131c9
⛔ Files ignored due to path filters (6)
components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/gen/java/org/wso2/carbon/identity/api/server/application/management/v1/ApplicationsApi.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/gen/java/org/wso2/carbon/identity/api/server/application/management/v1/ApplicationsApiService.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/gen/java/org/wso2/carbon/identity/api/server/application/management/v1/ClientSecretCreationRequest.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/gen/java/org/wso2/carbon/identity/api/server/application/management/v1/ClientSecretList.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/gen/java/org/wso2/carbon/identity/api/server/application/management/v1/ClientSecretResponse.javais excluded by!**/gen/**components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/gen/java/org/wso2/carbon/identity/api/server/application/management/v1/OpenIDConnectConfiguration.javais excluded by!**/gen/**
📒 Files selected for processing (6)
components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/ServerApplicationManagementService.javacomponents/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/inbound/oauth2/ApiModelToOAuthConsumerApp.javacomponents/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/inbound/oauth2/OAuthConsumerAppToApiModel.javacomponents/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/inbound/oauth2/OAuthInboundFunctions.javacomponents/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/impl/ApplicationsApiServiceImpl.javacomponents/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/resources/applications.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Expose the multiple client secrets lifecycle and client‑secret expiry through the Application Management REST API (v1). Adds dedicated endpoints to create, list, retrieve, and delete an application's OAuth2/OIDC client secrets, and surfaces the latest secret's expiry on the OIDC inbound configuration.
New endpoints (
/applications/{applicationId}/inbound-protocols/oidc/secrets)POST …/oidc/regenerate-secretnow requires the dedicatedinternal_application_mgt_client_secret_regeneratescope (it adds a new secret, removes all existing ones, and revokes the app's tokens). When the multiple client secrets feature is disabled, it falls back tointernal_application_mgt_client_secret_create.internal_org_application_mgt_client_secret_*variants.New API models
ClientSecretCreationRequest—expiresAt(Unix epoch seconds; must be a future time; 0 or omitted = non‑expiring).ClientSecretResponse—secretId,secretValue,expiresAt,status(ACTIVE/EXPIRED),latest.ClientSecretList—count,list[].OpenIDConnectConfigurationadditionsclientSecretExpiresAt— expiry of the client secret as Unix epoch seconds (0 = never). On create, sets the initial secret's expiry.multipleClientSecretsConfigured— flag indicating the app holds more than one secret.Both fields are effective in requests and present in responses only when multiple client secrets is enabled, and are stripped from the response when the caller lacks the client‑secret view scope.
Notes
409 Conflict.Related PRs
Related Issue
To be merged after
wso2-extensions/identity-inbound-auth-oauth#3284
wso2/carbon-identity-framework#8226