Repository navigation
dbeaver/pro#11122 Generalize SSO contracts and add scoped access tokens - #19
Merged
serge-rider merged 8 commits intoOct 26, 2026
Merged
Conversation
…neralize-sso-authorization
There was a problem hiding this comment.
🟡 Changes recommended
The token exchange path still dereferences the optional id_token, so access-token-only clients can fail despite a valid token response.
1 open issue
What changed in this PR
This pull request generalizes the shared DataDam SSO API from desktop-specific contracts to reusable OAuth-style contracts with scoped access tokens, resource indicators, explicit audiences, and optional identity tokens.
Changes:
- Adds RFC 6749 scope parsing, shared full-access scope constants, resource parameters, and audience-aware token verification.
- Replaces desktop-specific login, configuration, authorization, and token models with generic SSO contracts.
- Updates client transport, service orchestration, tests, and documentation for the new flows.
Blocking review note: DDSsoService.java still immediately requires token.idToken() after token exchange. Because id_token is optional, valid access-token-only exchanges can fail; identity-only handling should be separated from generic token exchange.
| File | Description |
|---|---|
README.md |
Documents the generalized SSO contracts, scopes, resources, audiences, and OAuth metadata. |
apis/com.dbeaver.datadam.sso.api/src/test/java/com/dbeaver/datadam/sso/api/DDSsoScopesTest.java |
Tests RFC 6749 scope parsing, formatting, deduplication, and invalid syntax. |
apis/com.dbeaver.datadam.sso.api/src/test/java/com/dbeaver/datadam/sso/api/client/DDSsoServiceTest.java |
Tests scoped tokens, resource transport, login approval, and generalized contracts. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoTokenResponse.java |
Defines access-token responses with granted scopes and optional identity tokens. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoTokenRequest.java |
Adds optional resource-indicator support to token requests. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoLoginApprovalResponse.java |
Defines the generalized login approval response. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoLoginApprovalRequest.java |
Defines the generalized login approval request. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoDesktopTokenResponse.java |
Removes the obsolete desktop-specific token response. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoConfigResponse.java |
Defines the generic SSO configuration response. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoAuthorizeRequest.java |
Adds resource and requested-scope authorization parameters. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/model/DDSsoAccessIdentity.java |
Carries verified audience and granted scopes with access identity claims. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/DDSsoScopes.java |
Implements RFC 6749 scope parsing and stable formatting. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/DDSsoConstants.java |
Adds OAuth, resource, metadata, audience, scope, and login constants. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/client/DDSsoTokenVerifier.java |
Verifies access-token purpose, audience, source, client, and scopes. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/client/DDSsoService.java |
Updates token exchange and login approval orchestration for generalized contracts. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/client/DDSsoClientConfig.java |
Adds resource and scope configuration. |
apis/com.dbeaver.datadam.sso.api/src/main/java/com/dbeaver/datadam/sso/api/client/DDSsoClient.java |
Sends OAuth grant and optional resource parameters and uses generic login approval endpoints. |
Review effort: Lite
serge-rider
approved these changes
Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes dbeaver/pro#11122
Summary
Related changes
Verification
AI assistance
Implementation and tests were developed with AI assistance.