(syncope) branch master updated: Hide OIDCC4UI providers' client secrets for non-admin users

[ilgrosso]

This is an automated email from the ASF dual-hosted git repository.

ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git


The following commit(s) were added to refs/heads/master by this push:
     new 74aa6fc73b Hide OIDCC4UI providers' client secrets for non-admin users
74aa6fc73b is described below

commit 74aa6fc73bb442eb041ef4e5f4da03b2438e5293
Author: Francesco Chicchiriccò <ilgro...@apache.org>
AuthorDate: Mon Aug 24 12:14:09 2026 +0200

    Hide OIDCC4UI providers' client secrets for non-admin users
---
 .../org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git 
a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java
 
b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java
index a6987855bd..90526eb144 100644
--- 
a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java
+++ 
b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java
@@ -33,6 +33,7 @@ import 
org.apache.syncope.core.persistence.api.dao.NotFoundException;
 import org.apache.syncope.core.persistence.api.dao.OIDCC4UIProviderDAO;
 import org.apache.syncope.core.persistence.api.entity.OIDCC4UIProvider;
 import 
org.apache.syncope.core.provisioning.api.data.OIDCC4UIProviderDataBinder;
+import org.apache.syncope.core.spring.security.AuthContextUtils;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -89,7 +90,16 @@ public class OIDCC4UIProviderLogic extends 
AbstractTransactionalLogic<OIDCC4UIPr
     @PreAuthorize("isAuthenticated()")
     @Transactional(readOnly = true)
     public List<OIDCC4UIProviderTO> list() {
-        return 
opDAO.findAll().stream().map(binder::getOIDCProviderTO).toList();
+        boolean isAdmin = 
AuthContextUtils.getAuthorizations().containsKey(OIDCC4UIEntitlement.OP_READ);
+        return opDAO.findAll().stream().
+                map(op -> {
+                    OIDCC4UIProviderTO opTO = binder.getOIDCProviderTO(op);
+                    if (!isAdmin) {
+                        opTO.setClientSecret(null);
+                    }
+                    return opTO;
+                }).
+                toList();
     }
 
     @PreAuthorize("hasRole('" + OIDCC4UIEntitlement.OP_READ + "')")