Discrepancy: Update Token Script requires explicit Client DN binding contrary to documentation

[polsson12]

Hi Janssen team,

I have observed a discrepancy between the Update Token script documentation and the actual behavior in the code (and runtime tests).

The Issue
The official documentation states:

If the Update token script is not associated with a client, then it will be applicable to all clients registered in the Jans Server. Which implies that all tokens obtained using the Jans server will reflect modifications as per the script.

However, based on our testing, the Update Token script does not run unless the script's DN is explicitly listed in the Client's configuration. It does not appear to execute globally by default.

Looking at ExternalScriptService.java, the logic appears to strictly filter scripts based on configuration, potentially missing a "run all if none specified" fallback for this script type.

Code Reference

jans/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalScriptService.java

Lines 162 to 173 in 1c947f2

	public List<CustomScriptConfiguration> getCustomScriptConfigurationsByDns(List<String> dns) {
	if (dns == null || dns.isEmpty() || customScriptConfigurations == null || customScriptConfigurations.isEmpty()) {
	return Lists.newArrayList();
	}
	List<CustomScriptConfiguration> scripts = Lists.newArrayList();
	for (CustomScriptConfiguration script : customScriptConfigurations) {
	if (dns.contains(script.getCustomScript().getDn())) {
	scripts.add(script);
	}
	}
	return scripts;
	}

Questions

1. Is this a documentation error? (Should the docs be updated to reflect that explicit binding is mandatory?)
2. Is this a code bug? (Was the intention to allow global execution as the docs state?)

Feature Request / Proposed Fix
For our use case, we require the ability to apply an Update Token script globally to all clients without manually modifying every client configuration.

If the current behavior (explicit binding only) is intended, could we request a feature in the upcoming version to support a "Global by Default" mode for Update Token scripts? This would align the code with the current documentation.

Steps to Reproduce

1. Enable a custom Update Token script.
2. Do not add the script DN to any Client configuration.
3. Perform a token request/refresh.
4. Observation: The script modifyAccessToken method is never triggered.
5. Correction: Add script DN to Client config -> Script triggers successfully.

[nynymike]

@yuriyz is there a way to apply a token script universally? I think so...

[yuriyz]

Currently we allow to run Update Token script only if it's assigned to client. I will add confuration property which will allow to run it universally. It's quick fix.

[yuriyz]

Created ticket for it #12837

[polsson12]

Thanks!

How come that documentation said it already had the functionality?

[nynymike]

Probably because it used to, and something changed the behavior.

[yuriyz]

Originally our scripts were global scripts and it always run (independent from clients). This approach did not give enough control. We moved to concept when script is run only if it's assigned to client. Documentation at that place was not updated.

I've just added new AS configuration property runAllUpdateTokenScripts (default value is false). If set it to true, even if UpdateToken script is not assigned to client, it will still run. It should be available with next release. Also I've corrected documentation.

#12844

@polsson12 thanks for the report and also let us know if you will notice any other discrepancies.