From 0131dcd8a5b3c226f3e5afd6e6360981dcf1b0b7 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 09 2016 09:06:03 +0000
Subject: [PATCH 1/2] Update location of display_name information


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/ipsilon/providers/openidc/plugins/common.py b/ipsilon/providers/openidc/plugins/common.py
index c4bd0cb..93eeb63 100644
--- a/ipsilon/providers/openidc/plugins/common.py
+++ b/ipsilon/providers/openidc/plugins/common.py
@@ -37,7 +37,10 @@ class OpenidCExtensionBase(Log):
         display_data = {}
         for scope in scopes:
             if scope in self.scopes:
-                display_data[scope] = self.scopes[scope]
+                if 'display_name' in self.scopes[scope]:
+                    display_data[scope] = self.scopes[scope]['display_name']
+                else:
+                    display_data[scope] = scope
         return display_data
 
     def enable(self, provider):

From 9decb28d4630938d30391cbe304195d247020b84 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 09 2016 09:30:42 +0000
Subject: [PATCH 2/2] Allow OpenIDC extensions to specify additional claims


This allows extensions to specify additional claims to be provided
with specific claims.
These would have to be mapped as user attributes.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/ipsilon/providers/openidc/auth.py b/ipsilon/providers/openidc/auth.py
index 5d10470..46a6722 100644
--- a/ipsilon/providers/openidc/auth.py
+++ b/ipsilon/providers/openidc/auth.py
@@ -536,6 +536,14 @@ class Authorization(AuthenticateRequest):
                         # pylint: disable=invalid-sequence-index
                         request_data['claims']['userinfo'][claim] = None
 
+        # Add claims from extensions
+        for n, e in self.cfg.extensions.available().items():
+            data = e.get_claims(request_data['scope'])
+            self.debug('%s returned %s' % (n, repr(data)))
+            if len(data) > 0:
+                # pylint: disable=invalid-sequence-index
+                request_data['claims']['userinfo'].extend(data)
+
         # Store data so we can continue with the request
         us = UserSession()
         user = us.get_user()
diff --git a/ipsilon/providers/openidc/plugins/common.py b/ipsilon/providers/openidc/plugins/common.py
index 93eeb63..64c24da 100644
--- a/ipsilon/providers/openidc/plugins/common.py
+++ b/ipsilon/providers/openidc/plugins/common.py
@@ -43,6 +43,19 @@ class OpenidCExtensionBase(Log):
                     display_data[scope] = scope
         return display_data
 
+    def get_claims(self, scopes):
+        if not self.enabled:
+            return {}
+
+        claims = []
+        for scope in scopes:
+            if scope in self.scopes and 'claims' in self.scopes[scope]:
+                data = self.scopes[scope]['claims']
+                if not isinstance(data, list):
+                    data = [data]
+                claims.extend(data)
+        return claims
+
     def enable(self, provider):
         self.enabled = True
         self.provider = provider