LG-12678 x509:presented attribute type

app/presenters/openid_connect_user_info_presenter.rb

@@ -76,7 +76,7 @@ def x509_attributes
     {
       x509_subject: stringify_attr(x509_data.subject),
       x509_issuer: stringify_attr(x509_data.issuer),
-      x509_presented: x509_data.presented,
+      x509_presented:,
     }
   end
 
@@ -154,6 +154,16 @@ def x509_session?
     identity.piv_cac_enabled?
   end
 
+  def x509_presented
+    if IdentityConfig.store.x509_presented_hash_attribute_requested_issuers.include?(
+      identity&.service_provider,
+    )
+      x509_data.presented
+    else
+      x509_data.presented.raw
+    end
+  end
+
   def active_profile
     identity.user&.active_profile
   end

config/application.yml.default

@@ -364,6 +364,7 @@ get_usps_proofing_results_job_request_delay_milliseconds: 1000
 voice_otp_pause_time: '0.5s'
 voice_otp_speech_rate: 'slow'
 weekly_auth_funnel_report_config: '[]'
+x509_presented_hash_attribute_requested_issuers: '[]'
 
 development:
   aamva_private_key: 123abc

lib/identity_config.rb

@@ -503,6 +503,7 @@ def self.build_store(config_map)
     config.add(:voice_otp_speech_rate)
     config.add(:vtm_url)
     config.add(:weekly_auth_funnel_report_config, type: :json)
+    config.add(:x509_presented_hash_attribute_requested_issuers, type: :json)
 
     @key_types = config.key_types
     @unused_keys = config_map.keys - config.written_env.keys

spec/presenters/openid_connect_user_info_presenter_spec.rb

@@ -5,7 +5,7 @@
 
   let(:rails_session_id) { SecureRandom.uuid }
   let(:scope) do
-    'openid email all_emails address phone profile social_security_number x509:subject'
+    'openid email all_emails address phone profile social_security_number x509'
   end
   let(:service_provider_ial) { 2 }
   let(:service_provider) { create(:service_provider, ial: service_provider_ial) }
@@ -79,14 +79,18 @@
       end
 
       context 'when a piv/cac was used as second factor' do
+        let(:x509_subject) { 'x509-subject' }
+        let(:presented) { true }
+        let(:issuer) { 'trusted issuer' }
+
         let(:x509) do
-          {
+          X509::Attributes.new_from_hash(
             subject: x509_subject,
-          }
+            presented:,
+            issuer:,
+          )
         end
 
-        let(:x509_subject) { 'x509-subject' }
-
         before do
           OutOfBandSessionAccessor.new(rails_session_id).put_x509(x509, 5.minutes.to_i)
         end
@@ -105,13 +109,36 @@
             it 'returns x509 attributes' do
               aggregate_failures do
                 expect(user_info[:x509_subject]).to eq(x509_subject)
+                expect(user_info[:x509_presented]).to eq(presented)
+                expect(user_info[:x509_issuer]).to eq(issuer)
               end
             end
 
             it 'renders values as simple strings as json' do
               json = user_info.as_json
 
               expect(json['x509_subject']).to eq(x509_subject)
+              expect(json['x509_presented']).to eq(presented)
+              expect(json['x509_issuer']).to eq(issuer)
+            end
+          end
+
+          context 'when the sp requested x509_presented scope before it was fixed to string' do
+            before do
+              expect(IdentityConfig.store).to receive(
+                :x509_presented_hash_attribute_requested_issuers,
+              ).
+                and_return([identity.service_provider])
+            end
+
+            it 'returns x509_presented as an (X509::Attribute' do
+              # This is guarding against partners who may have coded against
+              # a bug where we returning the wrong data type for x509_presented
+              aggregate_failures do
+                expect(user_info[:x509_subject]).to eq(x509_subject)
+                expect(user_info[:x509_presented].class).to eq(X509::Attribute)
+                expect(user_info[:x509_issuer]).to eq(issuer)
+              end
             end
           end
         end
@@ -121,6 +148,8 @@
             it 'returns no x509 attributes' do
               aggregate_failures do
                 expect(user_info[:x509_subject]).to be_blank
+                expect(user_info[:x509_issuer]).to be_blank
+                expect(user_info[:x509_presented]).to be_blank
               end
             end
           end