Feature - In-Flow Extension

.gitignore

@@ -22,4 +22,7 @@
 hs_err_pid*
 
 # Ignore everything in this directory
-target
+target
+
+# Maven versions plugin backup files
+*.versionsBackup

components/action-mgt/org.wso2.carbon.identity.action.execution/src/main/java/org/wso2/carbon/identity/action/execution/api/model/ActionType.java

@@ -29,7 +29,8 @@ public enum ActionType {
     PRE_UPDATE_PASSWORD,
     PRE_UPDATE_PROFILE,
     AUTHENTICATION,
-    PRE_ISSUE_ID_TOKEN;
+    PRE_ISSUE_ID_TOKEN,
+    FLOW_EXTENSION;
 
     public String getDisplayName() {
 

components/action-mgt/org.wso2.carbon.identity.action.execution/src/main/java/org/wso2/carbon/identity/action/execution/api/model/User.java

@@ -18,9 +18,18 @@
 
 package org.wso2.carbon.identity.action.execution.api.model;
 
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 /**
  * This class models the User.
@@ -30,9 +39,11 @@ public class User {
 
     private final String id;
     private final List<UserClaim> claims =  new ArrayList<>();
+    private final Map<String, char[]> userCredentials = new HashMap<>();
     private final List<String> groups = new ArrayList<>();
     private final List<String> roles = new ArrayList<>();
     private Organization organization;
+    private UserStore userStoreDomain;
     /**
      * Represents the user id when the user is shared across sub-organizations.
      * This field differs from the regular user id ({@link #id}) in scenarios where a user is accessed in the context
@@ -65,15 +76,18 @@ public User(Builder builder) {
 
         this.id = builder.id;
         this.claims.addAll(builder.claims);
+        this.userCredentials.putAll(builder.userCredentials);
         this.groups.addAll(builder.groups);
         this.roles.addAll(builder.roles);
         this.organization = builder.organization;
         this.sharedUserId = builder.sharedUserId;
         this.userType = builder.userType;
         this.federatedIdP = builder.federatedIdP;
         this.accessingOrganization = builder.accessingOrganization;
+        this.userStoreDomain = builder.userStoreDomain;
     }
 
+    @JsonInclude(JsonInclude.Include.NON_NULL)
     public String getId() {
 
         return id;
@@ -84,6 +98,11 @@ public List<UserClaim> getClaims() {
         return Collections.unmodifiableList(claims);
     }
 
+    public Map<String, char[]> getUserCredentials() {
+
+        return Collections.unmodifiableMap(userCredentials);
+    }
+
     public List<String> getGroups() {
 
         return Collections.unmodifiableList(groups);
@@ -99,6 +118,13 @@ public Organization getOrganization() {
         return organization;
     }
 
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    @JsonSerialize(using = UserStoreNameSerializer.class)
+    public UserStore getUserStoreDomain() {
+
+        return userStoreDomain;
+    }
+
     public String getSharedUserId() {
 
         return sharedUserId;
@@ -126,9 +152,11 @@ public static class Builder {
 
         private final String id;
         private final List<UserClaim> claims = new ArrayList<>();
+        private final Map<String, char[]> userCredentials = new HashMap<>();
         private final List<String> groups = new ArrayList<>();
         private final List<String> roles = new ArrayList<>();
         private Organization organization;
+        private UserStore userStoreDomain;
         private String sharedUserId;
         private String userType;
         private String federatedIdP;
@@ -163,6 +191,12 @@ public Builder organization(Organization organization) {
             return this;
         }
 
+        public Builder userStoreDomain(UserStore userStoreDomain) {
+
+            this.userStoreDomain = userStoreDomain;
+            return this;
+        }
+
         public Builder sharedUserId(String sharedUserId) {
 
             this.sharedUserId = sharedUserId;
@@ -187,9 +221,24 @@ public Builder accessingOrganization(Organization accessingOrganization) {
             return this;
         }
 
+        public Builder userCredentials(Map<String, char[]> userCredentials) {
+
+            this.userCredentials.putAll(userCredentials);
+            return this;
+        }
+
         public User build() {
 
             return new User(this);
         }
     }
+
+    private static class UserStoreNameSerializer extends JsonSerializer<UserStore> {
+
+        @Override
+        public void serialize(UserStore value, JsonGenerator gen, SerializerProvider serializers) throws IOException {
+
+            gen.writeString(value.getName() != null ? value.getName() : "");
+        }
+    }
 }

components/action-mgt/org.wso2.carbon.identity.action.execution/src/main/java/org/wso2/carbon/identity/action/execution/internal/service/impl/ActionExecutorServiceImpl.java

@@ -148,14 +148,12 @@ public ActionExecutionStatus execute(ActionType actionType, String actionId,
             throw new ActionExecutionException("Action Id cannot be blank.");
         }
 
-        try {
-            Action action = getActionByActionId(actionType, actionId, tenantDomain);
-            return execute(action, flowContext, tenantDomain);
-        } catch (ActionExecutionRuntimeException e) {
-            LOG.debug("Skip executing action for action type: " + actionType.name(), e);
-            // Skip executing actions when no action available is considered as action execution being successful.
+        Action action = getActionByActionId(actionType, actionId, tenantDomain);
+        if (action == null) {
+            LOG.debug("No action found for action Id: " + actionId + ". Skipping action execution.");
             return new SuccessStatus.Builder().setResponseContext(flowContext.getContextData()).build();
         }
+        return execute(action, flowContext, tenantDomain);
     }
 
     private ActionExecutionStatus<?> execute(Action action, FlowContext flowContext, String tenantDomain)

components/action-mgt/org.wso2.carbon.identity.action.execution/src/main/java/org/wso2/carbon/identity/action/execution/internal/util/ActionExecutorConfig.java

@@ -87,6 +87,8 @@ public boolean isExecutionForActionTypeEnabled(ActionType actionType) {
                 return isActionTypeEnabled(ActionTypeConfig.PRE_UPDATE_PROFILE.getActionTypeEnableProperty());
             case PRE_ISSUE_ID_TOKEN:
                 return isActionTypeEnabled(ActionTypeConfig.PRE_ISSUE_ID_TOKEN.getActionTypeEnableProperty());
+            case FLOW_EXTENSION:
+                return isActionTypeEnabled(ActionTypeConfig.FLOW_EXTENSION.getActionTypeEnableProperty());
             default:
                 return false;
         }
@@ -333,6 +335,8 @@ public String getRetiredUpToVersion(ActionType actionType) {
                 return getVersion(ActionTypeConfig.PRE_UPDATE_PROFILE.getRetiredUpToVersionProperty());
             case PRE_ISSUE_ID_TOKEN:
                 return getVersion(ActionTypeConfig.PRE_ISSUE_ID_TOKEN.getRetiredUpToVersionProperty());
+            case FLOW_EXTENSION:
+                return getVersion(ActionTypeConfig.FLOW_EXTENSION.getRetiredUpToVersionProperty());
             default:
                 return null;
         }
@@ -417,7 +421,13 @@ private enum ActionTypeConfig {
                 "Actions.Types.PreIssueIdToken.ActionRequest.ExcludedParameters.Parameter",
                 "Actions.Types.PreIssueIdToken.ActionRequest.AllowedHeaders.Header",
                 "Actions.Types.PreIssueIdToken.ActionRequest.AllowedParameters.Parameter",
-                "Actions.Types.PreIssueIdToken.Version.RetiredUpTo");
+                "Actions.Types.PreIssueIdToken.Version.RetiredUpTo"),
+        FLOW_EXTENSION("Actions.Types.FlowExtension.Enable",
+                "Actions.Types.FlowExtension.ActionRequest.ExcludedHeaders.Header",
+                "Actions.Types.FlowExtension.ActionRequest.ExcludedParameters.Parameter",
+                "Actions.Types.FlowExtension.ActionRequest.AllowedHeaders.Header",
+                "Actions.Types.FlowExtension.ActionRequest.AllowedParameters.Parameter",
+                "Actions.Types.FlowExtension.Version.RetiredUpTo");
 
         private final String actionTypeEnableProperty;
         private final String excludedHeadersProperty;

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/api/constant/ErrorMessage.java

@@ -43,8 +43,13 @@ public enum ErrorMessage {
             "An unsupported rule has been provided for action version %s."),
     ERROR_MAXIMUM_ATTRIBUTES_LIMIT_EXCEEDED("60011", "Maximum attributes limit exceeded.",
             "The number of configured attributes: %s exceeds the maximum allowed limit: %s"),
-    ERROR_INVALID_ATTRIBUTES("60012", "Invalid attribute provided.",
-            "%s"),
+    ERROR_INVALID_ATTRIBUTES("60012", "Invalid attribute provided.",  "%s"),
+    ERROR_EMPTY_ATTRIBUTE_VALUE("60013", "Invalid attribute provided.",
+            "Each attribute must be a non-empty string."),
+    ERROR_UNSUPPORTED_ATTRIBUTE("60014", "Unsupported attribute provided.",
+            "The attribute %s is not supported to be shared with the extension."),
+    ERROR_ACTION_NAME_ALREADY_EXISTS("60015", "Action name already exists.",
+            "An action with the name '%s' already exists for the given action type."),
 
     // Server errors.
     ERROR_WHILE_ADDING_ACTION("65001", "Error while adding Action.",

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/api/model/Action.java

@@ -75,7 +75,13 @@ public enum ActionTypes {
                 "PRE_ISSUE_ID_TOKEN",
                 "Pre Issue ID Token",
                 "Configure an extension point for modifying ID token via a custom service.",
-                Category.PRE_POST);
+                Category.PRE_POST),
+        FLOW_EXTENSION(
+                "flowExtension",
+                "FLOW_EXTENSION",
+                "Flow Extension",
+                "Configure an extension point within any flow via a custom service.",
+                Category.FLOW_EXTENSION);
 
         private final String pathParam;
         private final String actionType;
@@ -131,7 +137,8 @@ public static ActionTypes[] filterByCategory(Category category) {
          */
         public enum Category {
             PRE_POST,
-            IN_FLOW
+            IN_FLOW,
+            FLOW_EXTENSION
         }
     }
 

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/api/service/impl/DefaultActionValidator.java

@@ -249,6 +249,7 @@ private void validateAllowedParameters(List<String> allowedParametersInAction) t
         }
     }
 
+
     /**
      * Validate whether required fields exist.
      *

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/internal/dao/impl/ActionDTOModelResolverFactory.java

@@ -46,6 +46,8 @@ public static ActionDTOModelResolver getActionDTOModelResolver(Action.ActionType
                 return actionDTOModelResolvers.get(Action.ActionTypes.PRE_UPDATE_PASSWORD);
             case PRE_ISSUE_ACCESS_TOKEN:
                 return actionDTOModelResolvers.get(Action.ActionTypes.PRE_ISSUE_ACCESS_TOKEN);
+            case FLOW_EXTENSION:
+                return actionDTOModelResolvers.get(Action.ActionTypes.FLOW_EXTENSION);
             default:
                 return null;
         }

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/internal/service/impl/ActionConverterFactory.java

@@ -39,15 +39,7 @@ private ActionConverterFactory() {
 
     public static ActionConverter getActionConverter(Action.ActionTypes actionType) {
 
-        switch (actionType) {
-            case PRE_UPDATE_PROFILE:
-                return actionConverters.get(Action.ActionTypes.PRE_UPDATE_PROFILE);
-            case PRE_UPDATE_PASSWORD:
-                return actionConverters.get(Action.ActionTypes.PRE_UPDATE_PASSWORD);
-            case PRE_ISSUE_ACCESS_TOKEN:
-            default:
-                return null;
-        }
+        return actionConverters.get(actionType);
     }
 
     public static void registerActionConverter(ActionConverter actionConverter) {

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/internal/service/impl/ActionManagementServiceImpl.java

@@ -26,6 +26,7 @@
 import org.wso2.carbon.identity.action.management.api.exception.ActionMgtException;
 import org.wso2.carbon.identity.action.management.api.exception.ActionMgtServerException;
 import org.wso2.carbon.identity.action.management.api.model.Action;
+import org.wso2.carbon.identity.action.management.api.model.Action.ActionTypes;
 import org.wso2.carbon.identity.action.management.api.model.ActionDTO;
 import org.wso2.carbon.identity.action.management.api.model.Authentication;
 import org.wso2.carbon.identity.action.management.api.model.EndpointConfig;
@@ -76,6 +77,7 @@ public Action addAction(String actionType, Action action, String tenantDomain) t
         Action.ActionTypes castedActionType = Action.ActionTypes.valueOf(resolvedActionType);
         ActionValidatorFactory.getActionValidator(castedActionType).doPreAddActionValidations(
                 castedActionType, ActionManagementConfig.getInstance().getLatestVersion(castedActionType), action);
+        validateActionNameUniqueness(action.getName(), null, castedActionType, tenantId);
         // Check whether the maximum allowed actions per type is reached.
         validateMaxActionsPerType(resolvedActionType, tenantDomain);
         String generatedActionId = UUID.randomUUID().toString();
@@ -161,6 +163,7 @@ public Action updateAction(String actionType, String actionId, Action action, St
         Action.ActionTypes castedActionType = Action.ActionTypes.valueOf(resolvedActionType);
         ActionValidatorFactory.getActionValidator(castedActionType).doPreUpdateActionValidations(
                 castedActionType, resolveActionVersionAtUpdating(action, existingActionDTO), action);
+        validateActionNameUniqueness(action.getName(), actionId, castedActionType, tenantId);
         ActionDTO updatingActionDTO = buildActionDTOForUpdate(resolvedActionType, actionId, action);
 
         DAO_FACADE.updateAction(updatingActionDTO, existingActionDTO, tenantId);
@@ -317,8 +320,10 @@ private String getActionTypeFromPath(String actionType) throws ActionMgtClientEx
      */
     private void validateMaxActionsPerType(String actionType, String tenantDomain) throws ActionMgtException {
 
-        // In-flow actions are not limited by the maximum actions per action type; eg: AUTHENTICATION action type.
-        if (Action.ActionTypes.Category.IN_FLOW.equals(Action.ActionTypes.valueOf(actionType).getCategory())) {
+        // In-flow and extension actions are not limited by the maximum actions per action type.
+        Action.ActionTypes.Category category = Action.ActionTypes.valueOf(actionType).getCategory();
+        if (Action.ActionTypes.Category.IN_FLOW.equals(category)
+                || Action.ActionTypes.Category.FLOW_EXTENSION.equals(category)) {
             return;
         }
         Map<String, Integer> actionsCountPerType = getActionsCountPerType(tenantDomain);
@@ -365,8 +370,13 @@ private ActionDTO buildActionDTOForCreation(String actionType, String actionId,
             throws ActionMgtServerException {
 
         Action.ActionTypes resolvedActionType = Action.ActionTypes.valueOf(actionType);
-        Action.Status resolvedStatus = resolvedActionType.getCategory() == Action.ActionTypes.Category.IN_FLOW ?
-                Action.Status.ACTIVE : Action.Status.INACTIVE;
+        // Only IN_FLOW and FLOW_EXTENSION category actions (e.g., AUTHENTICATION, FLOW_EXTENSION)
+        // start ACTIVE and can be used immediately. All other categories (e.g., PRE_POST) start
+        // INACTIVE and require explicit activation.
+        Action.ActionTypes.Category category = resolvedActionType.getCategory();
+        Action.Status resolvedStatus = (category == Action.ActionTypes.Category.IN_FLOW
+                || category == Action.ActionTypes.Category.FLOW_EXTENSION)
+                ? Action.Status.ACTIVE : Action.Status.INACTIVE;
 
         String actionVersion = ActionManagementConfig.getInstance().getLatestVersion(resolvedActionType);
 
@@ -470,4 +480,21 @@ private Action buildAction(String actionType, ActionDTO actionDTO) {
                 .rule(actionDTO.getActionRule())
                 .build();
     }
+
+    private void validateActionNameUniqueness(String name, String excludeId, ActionTypes actionType, int tenantId)
+            throws ActionMgtException {
+
+        if (name == null || !ActionTypes.FLOW_EXTENSION.equals(actionType)) {
+            return;
+        }
+        List<ActionDTO> existingActions = DAO_FACADE.getActionsByActionType(actionType.getActionType(), tenantId);
+        boolean duplicateExists = existingActions.stream()
+                .filter(dto -> excludeId == null || !excludeId.equals(dto.getId()))
+                .anyMatch(dto -> name.equalsIgnoreCase(dto.getName()));
+
+        if (duplicateExists) {
+            throw ActionManagementExceptionHandler.handleClientException(
+                    ErrorMessage.ERROR_ACTION_NAME_ALREADY_EXISTS, name);
+        }
+    }
 }

components/action-mgt/org.wso2.carbon.identity.action.management/src/main/java/org/wso2/carbon/identity/action/management/internal/util/ActionManagementConfig.java

@@ -94,7 +94,11 @@ public String getLatestVersion(ActionTypes actionType) throws ActionMgtServerExc
                 return getVersion(
                         ActionTypeConfig.PRE_UPDATE_PROFILE.getLatestVersionProperty(), actionType);
             case PRE_ISSUE_ID_TOKEN:
-                return getVersion(ActionTypeConfig.PRE_ISSUE_ID_TOKEN.getLatestVersionProperty(), actionType);
+                return getVersion(
+                        ActionTypeConfig.PRE_ISSUE_ID_TOKEN.getLatestVersionProperty(), actionType);
+            case FLOW_EXTENSION:
+                return getVersion(
+                        ActionTypeConfig.FLOW_EXTENSION.getLatestVersionProperty(), actionType);
             default:
                 throw new ActionMgtServerException("Unsupported action type: " + actionType);
         }
@@ -140,6 +144,10 @@ public enum ActionTypeConfig {
                 "Actions.Types.PreIssueIdToken.ActionRequest.ExcludedHeaders.Header",
                 "Actions.Types.PreIssueIdToken.ActionRequest.ExcludedParameters.Parameter",
                 "Actions.Types.PreIssueIdToken.Version.Latest"
+        ),
+        FLOW_EXTENSION(
+                "Actions.Types.FlowExtension.ActionRequest.ExcludedHeaders.Header",
+                "Actions.Types.FlowExtension.Version.Latest"
         );
 
         private final String excludedHeadersProperty;
@@ -153,6 +161,11 @@ public enum ActionTypeConfig {
             this.latestVersionProperty = latestVersionProperty;
         }
 
+        ActionTypeConfig(String excludedHeadersProperty, String latestVersionProperty) {
+
+            this(excludedHeadersProperty, null, latestVersionProperty);
+        }
+
         public String getExcludedHeadersProperty() {
 
             return excludedHeadersProperty;