Add openappstack_roles claim

consent_provider/db.py

@@ -21,6 +21,13 @@ class User():
                         name
                     }}
                 }}
+            }},
+            roles{{
+                edges{{
+                    node{{
+                        name
+                    }}
+                }}
             }}
             }}}}'''.format(self.username).strip()
         result = loads(graphql_client.execute(querystring))
@@ -28,6 +35,8 @@ class User():
             data = result["data"]["getUser"]
             self.applications = list(map(lambda x: x["node"]["name"],
                                          data["applications"]["edges"]))
+            self.roles = list(map(lambda x: x["node"]["name"],
+                                         data["roles"]["edges"]))
             self.email = data["email"]
 
     def has_app_permission(self, appname):
@@ -38,5 +47,6 @@ class User():
             "id_token": {
                 "name": self.username,
                 "preferred_username": self.username,
-                "email" : self.email}
+                "email" : self.email,
+                "openappstack_roles": self.roles}
         }

test/create-hydra-client.sh

@@ -5,8 +5,9 @@ SECRET=$2
 HOST=$3
 PORT=$4
 REDIRECT_URI=$5
+SCOPES="openid profile email openappstack_roles"
 
 curl --header "Content-Type: application/json" \
     --request POST \
-    --data "{\"client_id\": \"$KEY\", \"client_name\": \"$KEY\", \"client_secret\": \"$SECRET\", \"redirect_uris\": [\"$REDIRECT_URI\"], \"scope\": \"openid profile email\", \"grant-types\": \"authorization_code,refresh_token\", \"response_types\": [\"code\"], \"token_endpoint_auth_method\": \"client_secret_post\"}" \
+    --data "{\"client_id\": \"$KEY\", \"client_name\": \"$KEY\", \"client_secret\": \"$SECRET\", \"redirect_uris\": [\"$REDIRECT_URI\"], \"scope\": \"$SCOPES\", \"grant-types\": \"authorization_code,refresh_token\", \"response_types\": [\"code\"], \"token_endpoint_auth_method\": \"client_secret_post\"}" \
     http://$HOST:$PORT/clients

test/login_logout/app.py

@@ -26,7 +26,7 @@ sso = oauth.remote_app(
     access_token_url=ACCESS_TOKEN_URL,
     authorize_url=AUTHORIZE_URL,
     consumer_key=KEY,
-    request_token_params={'state': lambda: security.gen_salt(10), "scope": "openid profile email"},
+    request_token_params={'state': lambda: security.gen_salt(10), "scope": "openid profile email openappstack_roles"},
     consumer_secret=SECRET)
 
 @sso.tokengetter

user-panel @ 1ba28f45

-Subproject commit 5ee76d3dd010ff9893b9d61dbb7c9660758c8ddc
+Subproject commit 1ba28f459e1c5804432f7da7ad394895155f5a2a