The jwt-bearer grant confuses the internal (mapped) authorities(scopes) from the incoming(external) groups

The way the flow should work is

1. Extract external groups via the external_groups attribute mapping
2. Filter the external groups via the external group white list (Note #1)
3. Store the filtered external groups (external authorities)
4. Map the filtered external groups to scope, and store the scopes (authorities)

Note #1
For LDAP, and empty whitelist means no external groups are allowed
For SAML and OAUTH/OIDC an empty whitelist means all external groups are allowed

Author: fhanik

server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManager.java

@@ -271,6 +271,7 @@ public AuthenticationData getExternalAuthenticationDetails(Authentication authen
             authenticationData.setUsername(username);
 
             List<? extends GrantedAuthority> oidcAuthorities = extractExternalOAuthUserAuthorities(attributeMappings, claims);
+            oidcAuthorities = filterOidcAuthorities(config, oidcAuthorities);
             List<? extends GrantedAuthority> authorities;
             AbstractExternalOAuthIdentityProviderDefinition.OAuthGroupMappingMode groupMappingMode = config.getGroupMappingMode() != null ?
                     config.getGroupMappingMode() : AbstractExternalOAuthIdentityProviderDefinition.OAuthGroupMappingMode.EXPLICITLY_MAPPED;
@@ -283,7 +284,8 @@ public AuthenticationData getExternalAuthenticationDetails(Authentication authen
                     authorities = mapAuthorities(codeToken.getOrigin(), oidcAuthorities);
                     break;
             }
-            authenticationData.setAuthorities(filterOidcAuthorities(config, authorities));
+            authenticationData.setAuthorities(authorities); //the filter should apply to external authorities - not internal
+            authenticationData.setExternalAuthorities(oidcAuthorities);
             ofNullable(attributeMappings).ifPresent(map -> authenticationData.setAttributeMappings(new HashMap<>(map)));
             return authenticationData;
         }
@@ -358,7 +360,7 @@ protected void populateAuthenticationAttributes(UaaAuthentication authentication
             authentication.setUserAttributes(userAttributes);
             authentication.setExternalGroups(
                     ofNullable(
-                            authenticationData.getAuthorities()
+                            authenticationData.getExternalAuthorities()
                     )
                             .orElse(emptyList())
                             .stream()
@@ -975,6 +977,7 @@ protected static class AuthenticationData {
         private Map<String, Object> claims;
         private String username;
         private List<? extends GrantedAuthority> authorities;
+        private List<? extends GrantedAuthority> externalAuthorities;
         private Map<String, Object> attributeMappings;
 
         public Map<String, Object> getAttributeMappings() {
@@ -1008,5 +1011,13 @@ public List<? extends GrantedAuthority> getAuthorities() {
         public void setAuthorities(List<? extends GrantedAuthority> authorities) {
             this.authorities = authorities;
         }
+
+        public List<? extends GrantedAuthority> getExternalAuthorities() {
+            return externalAuthorities;
+        }
+
+        public void setExternalAuthorities(List<? extends GrantedAuthority> externalAuthorities) {
+            this.externalAuthorities = externalAuthorities;
+        }
     }
 }

server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/ExternalOAuthAuthenticationManagerTest.java

@@ -419,7 +419,7 @@ void getExternalAuthenticationDetails_whenUaaToken_internalAndExternalRolesAreDi
         //external authorities
         assertThat(authenticationData.getExternalAuthorities()).hasSize(2);
         Set<String> externalAuthorities = AuthorityUtils.authorityListToSet(authenticationData.getExternalAuthorities());
-        assertThat(roles.toArray()).contains(externalAuthorities.toArray());
+        assertThat(externalAuthorities).containsAll(roles);
         //internal (mapped) authorities
         assertThat(authenticationData.getAuthorities()).hasSize(3);
         Set<String> internalAuthorities = AuthorityUtils.authorityListToSet(authenticationData.getAuthorities());
@@ -466,7 +466,7 @@ void getExternalAuthenticationDetails_whenUaaToken_ExternalRolesAreFiltered() {
         //external authorities
         assertThat(authenticationData.getExternalAuthorities()).hasSize(1);
         Set<String> externalAuthorities = AuthorityUtils.authorityListToSet(authenticationData.getExternalAuthorities());
-        assertThat(roles.toArray()).contains(externalAuthorities.toArray());
+        assertThat(externalAuthorities).containsExactly("manager.us");
         //internal (mapped) authorities
         assertThat(authenticationData.getAuthorities()).hasSize(1);
         Set<String> internalAuthorities = AuthorityUtils.authorityListToSet(authenticationData.getAuthorities());