Repository: privacyidea/privacyidea

Issue:
Add more user details in auth response
The user-detail policy returns user details.

http://privacyidea.readthedocs.io/en/latest/policies/authorization.html#add-user-in-response

In addition to 

    "detail": {
        "user": {
            "username": "cornelius",
            "givenname": "Cornelius",
            "surname": "Kölbel",

we could add a further branch with the ``resolver``-name and ``realm``-name.

    "detail": {
        "user-resolver": <resolvername>,
        "user-realm": <realmname>

This could be triggered by the same policy.

@fredreichbier Or do you think we need an additional policy?


Discussion:
Hmm yeah, spontaneously, I would think that implementing this via an additional policy would be more consistent?
Yes, there migh be scenarios, where we might to tell the ``user-resolver`` but we do not want to "disclose" the user's phone number... etc.
OK, I add an extra policy. This makes sense. But I would add the policy to the same decorator, since the policies ``ADD_USER`` and ``ADD_RESOLVER`` are always at the same place / always decorate the same function...

Resolving patch:
diff --git a/privacyidea/api/lib/postpolicy.py b/privacyidea/api/lib/postpolicy.py
--- a/privacyidea/api/lib/postpolicy.py
+++ b/privacyidea/api/lib/postpolicy.py
@@ -290,10 +290,11 @@ def add_user_detail_to_response(request, response):
     content = json.loads(response.data)
     policy_object = g.policy_object
 
+    # Check for ADD USER IN RESPONSE
     detail_pol = policy_object.get_policies(action=ACTION.ADDUSERINRESPONSE,
-                                           scope=SCOPE.AUTHZ,
-                                           client=g.client_ip,
-                                           active=True)
+                                            scope=SCOPE.AUTHZ,
+                                            client=g.client_ip,
+                                            active=True)
 
     if detail_pol and content.get("result", {}).get("value") and request.User:
         # The policy was set, we need to add the user
@@ -306,6 +307,18 @@ def add_user_detail_to_response(request, response):
         content["detail"]["user"] = ui
         response.data = json.dumps(content)
 
+    # Check for ADD RESOLVER IN RESPONSE
+    detail_pol = policy_object.get_policies(action=ACTION.ADDRESOLVERINRESPONSE,
+                                            scope=SCOPE.AUTHZ,
+                                            client=g.client_ip,
+                                            active=True)
+
+    if detail_pol and content.get("result", {}).get("value") and request.User:
+        # The policy was set, we need to add the resolver and the realm
+        content["detail"]["user-resolver"] = request.User.resolver
+        content["detail"]["user-realm"] = request.User.realm
+        response.data = json.dumps(content)
+
     return response
 
 
diff --git a/privacyidea/lib/policy.py b/privacyidea/lib/policy.py
--- a/privacyidea/lib/policy.py
+++ b/privacyidea/lib/policy.py
@@ -233,6 +233,7 @@ class ACTION(object):
     MAXTOKENUSER = "max_token_per_user"
     NODETAILSUCCESS = "no_detail_on_success"
     ADDUSERINRESPONSE = "add_user_in_response"
+    ADDRESOLVERINRESPONSE = "add_resolver_in_response"
     NODETAILFAIL = "no_detail_on_fail"
     OTPPIN = "otppin"
     OTPPINRANDOM = "otp_pin_random"
@@ -1578,6 +1579,11 @@ def get_static_policy_definitions(scope=None):
                 'desc': _('In case of successful authentication user data '
                           'will be added in the detail branch of the '
                           'authentication response.')},
+            ACTION.ADDRESOLVERINRESPONSE: {
+                'type': 'bool',
+                'desc': _('In case of successful authentication the user resolver and '
+                          'realm will be added in the detail branch of the '
+                          'authentication response.')},
             ACTION.APIKEY: {
                 'type': 'bool',
                 'desc': _('The sending of an API Auth Key is required during'


Test patch:
diff --git a/tests/test_api_lib_policy.py b/tests/test_api_lib_policy.py
--- a/tests/test_api_lib_policy.py
+++ b/tests/test_api_lib_policy.py
@@ -1415,7 +1415,7 @@ def test_04_add_user_in_response(self):
         self.assertTrue("user" not in jresult.get("detail"), jresult)
 
         # A successful get a user added
-        # Set a policy, that does not allow the detail on success
+        # Set a policy, that adds user info to detail
         set_policy(name="pol_add_user",
                    scope=SCOPE.AUTHZ,
                    action=ACTION.ADDUSERINRESPONSE, client="10.0.0.0/8")
@@ -1424,7 +1424,24 @@ def test_04_add_user_in_response(self):
         new_response = add_user_detail_to_response(req, resp)
         jresult = json.loads(new_response.data)
         self.assertTrue("user" in jresult.get("detail"), jresult)
+        self.assertFalse("user-resolver" in jresult.get("detail"), jresult)
+        self.assertFalse("user-realm" in jresult.get("detail"), jresult)
+
+        # set a policy that adds user resolver to detail
+        set_policy(name="pol_add_resolver",
+                   scope=SCOPE.AUTHZ,
+                   action=ACTION.ADDRESOLVERINRESPONSE, client="10.0.0.0/8")
+        g.policy_object = PolicyClass()
+
+        new_response = add_user_detail_to_response(req, resp)
+        jresult = json.loads(new_response.data)
+        self.assertTrue("user-resolver" in jresult.get("detail"), jresult)
+        self.assertEqual(jresult.get("detail").get("user-resolver"), self.resolvername1)
+        self.assertTrue("user-realm" in jresult.get("detail"), jresult)
+        self.assertEqual(jresult.get("detail").get("user-realm"), self.realm1)
+
         delete_policy("pol_add_user")
+        delete_policy("pol_add_resolver")
 
     def test_05_autoassign_any_pin(self):
         # init a token, that does has no uwser