Fix role claim returned for applications with no role claim set

[DilshanSenarath]

Purpose

For an application with no role claim set, the API returned the legacy role claim (http://wso2.org/claims/role), while the authentication runtime resolves http://wso2.org/claims/roles when group and role separation is enabled. The API therefore returned a claim the runtime never emits, and echoing that value back on an update could fail validation because the legacy claim is filtered out of the local claim list.

The returned claim is now selected by the new ReturnLegacyRoleClaimInApplicationResponse config, which is enabled by default so existing behaviour is unchanged. Setting it to false returns the runtime resolved claim:

[legacy_claims]
return_legacy_role_claim_in_application_response = false

Also points carbon.identity.framework.version at 7.11.169. Depends on wso2/carbon-identity-framework#8231, which must be released first.

Related Issue

wso2/product-is#28185

[coderabbitai]

📝 Walkthrough

Summary

• Added configurable role-claim selection for applications without an explicitly configured role claim, preserving legacy behavior by default.
• Updated the Carbon Identity Framework dependency to version 7.11.169.

Walkthrough

The application model conversion now selects the role claim URI conditionally when an application’s role claim is unset and the local claim dialect is enabled. It reads RETURN_LEGACY_ROLE_CLAIM_IN_APPLICATION_RESPONSE to choose between the local groups claim URI and the local role claim URI. The Carbon Identity framework Maven property is also updated from 7.11.160 to 7.11.169.

Suggested reviewers: thumimku

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description only covers Purpose and Related Issue; most required template sections are missing.	Add the missing template sections: Goals, Approach, User stories, checklist, Release note, Documentation, tests, and other applicable fields.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main behavior change: returning the correct role claim when none is set.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/ServiceProviderToApiModel.java (1)

448-455: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add regression coverage for claim selection.

Cover unset, explicit true, explicit false, and invalid configuration values so both response modes remain stable.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/ServiceProviderToApiModel.java`
around lines 448 - 455, In getRoleClaimUriForUnsetRoleClaim, add regression
tests covering a missing configuration value, explicit true, explicit false, and
invalid values; assert each selects the expected claim URI and preserves both
legacy and local-group response modes.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/ServiceProviderToApiModel.java`:
- Around line 448-455: Update getRoleClaimUriForUnsetRoleClaim so only a
non-null configuration value whose trimmed text explicitly equals "false"
selects IdentityUtil.getLocalGroupsClaimURI(). Preserve
FrameworkConstants.LOCAL_ROLE_CLAIM_URI for null, malformed, whitespace-padded,
or any other values, without using Boolean.parseBoolean.

---

Nitpick comments:
In
`@components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/ServiceProviderToApiModel.java`:
- Around line 448-455: In getRoleClaimUriForUnsetRoleClaim, add regression tests
covering a missing configuration value, explicit true, explicit false, and
invalid values; assert each selects the expected claim URI and preserves both
legacy and local-group response modes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b41ad8cf-4420-4b46-996e-9fd1ff35f92e

📥 Commits

Reviewing files that changed from the base of the PR and between 9e144a5 and b7ba1d4.

📒 Files selected for processing (2)

• components/org.wso2.carbon.identity.api.server.application.management/org.wso2.carbon.identity.api.server.application.management.v1/src/main/java/org/wso2/carbon/identity/api/server/application/management/v1/core/functions/application/ServiceProviderToApiModel.java
• pom.xml

[sadilchamishka]

Suggested change

	if (returnLegacyRoleClaim != null && !Boolean.parseBoolean(returnLegacyRoleClaim)) {
	if (!Boolean.parseBoolean(returnLegacyRoleClaim)) {