Modify OAuth client id to be unique across tenant instead of server - Tenant resolving

[ThaminduDilshan]

Introduction

Currently the client ID is considered to be unique across the server and as a result the same client ID cannot be used in two different tenants. However, organization bound client ID is a valid requirement and we should provide this capability. This feature requires enabling tenant qualified URLs and tenanted sessions.

When tenant qualified URLs are enabled,

• Tenant will always be available in the context or thread local. Hence the application resolving logic can be modified to retrieve the application using both the consumer key and tenant ID.
• The proposed solution is to modify the underline DAO implementation to include the tenant ID in places where it query for apps by giving the client ID. All the DB queries will be modified to include the tenant ID.
• The tenant ID will be retrieved using a utility method added to the “IdentityTenantUtil” class.

when tenant-qualified URLs are disabled,

• The tenant won’t be available in the context or thread local.
• The client ID will be considered unique across the server and firstly the tenant has to be resolved.
• The proposed solution is to perform this at the valve level. We’ll be introducing a new valve and when a request hits that valve, if that request is an oauth request and if tenant-qualified urls are disabled, the client id will be extracted and app tenant will be queried. The valve will only be enabled for non tenant qualified cases.

Proposed changes in this pull request

• Introduce the new valve to resolve OAuth application tenant.
• Application tenant query param resolving in BasicClientAuthenticationHandler.
• Unit tests.

Related Issue

• Support same client Id for applications over different tenants wso2/product-is#16370

Related PRs

• Modify OAuth client id to be unique across tenant instead of server and DB script wso2/carbon-identity-framework#4847
• Modify OAuth client id to be unique across tenant instead of server identity-inbound-auth-oauth#2131
• Update catalina.xml j2 file, artifacts and integration tests wso2/product-is#16632

Checklist (for reviewing)

General

• Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
• Is the PR labeled correctly?

Functionality

• Are all requirements met? Compare implemented functionality with the requirements specification.
• Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

• Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
• Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
• Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

• Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
• If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
• If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

• Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
• Are all UI and API inputs run through forms or serializers?
• Are all external inputs validated and sanitized appropriately?
• Does all branching logic have a default case?
• Does this solution handle outliers and edge cases gracefully?
• Are all external communications secured and restricted to SSL?

Documentation

• Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
• Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
• Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.