k2hr3-api 1.0.25 → 1.0.27

package/ChangeLog

@@ -1,3 +1,15 @@
+k2hr3-api (1.0.27) unstable; urgency=low
+
+  * Updated TENANT API and fixed bugs in TENANT API - #104
+
+ -- Takeshi Nakatani <ggtakec@gmail.com>  Tue, 25 Jul 2023 16:16:10 +0900
+
+k2hr3-api (1.0.26) unstable; urgency=low
+
+  * Added response object members in userToken GET API - #102
+
+ -- Takeshi Nakatani <ggtakec@gmail.com>  Thu, 13 Jul 2023 09:11:09 +0900
+
 k2hr3-api (1.0.25) unstable; urgency=low
 
   * Added TENANT API for Local Tenant and updated etc - #100

package/lib/k2hr3dkc.js

@@ -2226,8 +2226,80 @@ function rawRemoveUserFromTenant(dkcobj_permanent, tenant, user)
 }
 
 //---------------------------------------------------------
-// Common remove user from local tenant
+// Common remove local tenant
 //---------------------------------------------------------
+//	tenant		: tenant name
+//	id			: tenant id
+//
+//	result		: true/false
+//
+function rawRemoveLocalTenantEx(dkcobj_permanent, tenant, user, id)
+{
+	if(!(dkcobj_permanent instanceof Object) || !dkcobj_permanent.isPermanent()){
+		r3logger.elog('parameter dkcobj_permanent is not object or not permanent');
+		return false;
+	}
+
+	if(!apiutil.isSafeStrings(tenant, user, id)){
+		r3logger.elog('some parameters are wrong : tenant=' + JSON.stringify(tenant) + ', user=' + JSON.stringify(user) + ', id=' + JSON.stringify(id));
+		return false;
+	}
+
+	//
+	// Keys
+	//
+	var	keys = r3keys(user, tenant);
+
+	//
+	// Check tenant name
+	//
+	if(0 !== tenant.indexOf(keys.VALUE_PREFIX_LOCAL_TENANT)){
+		// Not have prefix("local@")
+		r3logger.elog('tenant(' + tenant + ') must be start ' + keys.VALUE_PREFIX_LOCAL_TENANT + ' prefix for local tenant.');
+		return false;
+	}
+
+	//
+	// Find tenant
+	//
+	var	result = rawFindTenantEx(dkcobj_permanent, tenant, user, id);
+	if(!apiutil.isSafeEntity(result)){
+		r3logger.elog('could not find tenant(' + tenant + ') with user=' + JSON.stringify(user) + ' and id=' + JSON.stringify(id));
+		return false;
+	}
+
+	//
+	// Check user in tenant user list
+	//
+	if(!apiutil.findStringInArray(result.users, user)){
+		r3logger.elog('user(' + user + ') is not tenant(' + tenant + ') user member.');
+		return false;
+	}
+
+	//
+	// Remove all user from tenant
+	//
+	// [NOTE]
+	// Deleting all users of a tenant automatically deletes the tenant.
+	//
+	var	error = false;
+	if(apiutil.isArray(result.users)){
+		for(var cnt = 0; cnt < result.users.length; ++cnt){
+			var	delete_user_name = result.users[cnt].replace(keys.USER_TOP_KEY + ':', '');
+			if(!rawRemoveUserFromLocalTenantEx(dkcobj_permanent, tenant, delete_user_name, id)){
+				r3logger.elog('could not delete user(' + delete_user_name + ') from local tenant(' + tenant + '), id(' + id + '), but continue...');
+				error = true;
+			}
+		}
+	}
+	if(error){
+		r3logger.elog('failed to remove some user in local tenant.');
+		return false;
+	}
+
+	return true;
+}
+
 //	tenant		: tenant name
 //	user		: user name
 //	id			: tenant id
@@ -2237,7 +2309,7 @@ function rawRemoveUserFromTenant(dkcobj_permanent, tenant, user)
 //					message:		null or error message
 //				}
 //
-function rawRemoveUserFromLocalTenant(tenant, user, id)
+function rawRemoveLocalTenant(tenant, user, id)
 {
 	var	resobj = {result: true, message: null};
 
@@ -2257,6 +2329,39 @@ function rawRemoveUserFromLocalTenant(tenant, user, id)
 		return resobj;
 	}
 
+	if(!rawRemoveLocalTenantEx(dkcobj, tenant, user, id)){
+		resobj.result	= false;
+		resobj.message	= 'could not remove local tenant(' + JSON.stringify(tenant) + '), id(' + JSON.stringify(id) + ').';
+		r3logger.elog(resobj.message);
+		dkcobj.clean();
+		return resobj;
+	}
+	dkcobj.clean();
+
+	return resobj;
+}
+
+//---------------------------------------------------------
+// Common remove user from local tenant
+//---------------------------------------------------------
+//	tenant		: tenant name
+//	user		: user name
+//	id			: tenant id
+//
+//	result		: true/false
+//
+function rawRemoveUserFromLocalTenantEx(dkcobj_permanent, tenant, user, id)
+{
+	if(!(dkcobj_permanent instanceof Object) || !dkcobj_permanent.isPermanent()){
+		r3logger.elog('parameter dkcobj_permanent is not object or not permanent');
+		return false;
+	}
+
+	if(!apiutil.isSafeStrings(tenant, user, id)){
+		r3logger.elog('some parameters are wrong : tenant=' + JSON.stringify(tenant) + ', user=' + JSON.stringify(user) + ', id=' + JSON.stringify(id));
+		return false;
+	}
+
 	//
 	// Keys
 	//
@@ -2267,53 +2372,81 @@ function rawRemoveUserFromLocalTenant(tenant, user, id)
 	//
 	if(0 !== tenant.indexOf(keys.VALUE_PREFIX_LOCAL_TENANT)){
 		// Not have prefix("local@")
-		resobj.result	= false;
-		resobj.message	= 'tenant(' + tenant + ') must be start ' + keys.VALUE_PREFIX_LOCAL_TENANT + ' prefix for local tenant.';
-		r3logger.elog(resobj.message);
-		dkcobj.clean();
-		return resobj;
+		r3logger.elog('tenant(' + tenant + ') must be start ' + keys.VALUE_PREFIX_LOCAL_TENANT + ' prefix for local tenant.');
+		return false;
 	}
 
 	//
 	// Find tenant
 	//
-	var	result = rawFindTenantEx(dkcobj, tenant, user, id);
+	var	result = rawFindTenantEx(dkcobj_permanent, tenant, user, id);
 	if(!apiutil.isSafeEntity(result)){
-		resobj.result	= false;
-		resobj.message	= 'could not find tenant(' + tenant + ') with user=' + JSON.stringify(user) + ' and id=' + JSON.stringify(id);
-		r3logger.elog(resobj.message);
-		dkcobj.clean();
-		return resobj;
+		r3logger.elog('could not find tenant(' + tenant + ') with user=' + JSON.stringify(user) + ' and id=' + JSON.stringify(id));
+		return false;
 	}
 
 	//
 	// Check user list in tenant
 	//
 	if(!apiutil.findStringInArray(result.users, user)){
-		resobj.result	= false;
-		resobj.message	= 'user(' + user + ') is not tenant(' + tenant + ') member.';
-		r3logger.elog(resobj.message);
-		dkcobj.clean();
-		return resobj;
+		r3logger.elog('user(' + user + ') is not tenant(' + tenant + ') member.');
+		return false;
 	}
 
 	//
 	// Remove tenant from user
 	//
-	if(!rawRemoveTenantFromUser(dkcobj, user, tenant)){
+	if(!rawRemoveTenantFromUser(dkcobj_permanent, user, tenant)){
+		r3logger.elog('failed to remove tenant(' + tenant + ') from user(' + user + ').');
+		return false;
+	}
+
+	//
+	// Remove user from tenant
+	//
+	// [NOTE]
+	// If all users of a tenant disappear after deletion, the tenant is automatically deleted.
+	//
+	if(!rawRemoveUserFromTenant(dkcobj_permanent, tenant, user)){
+		r3logger.elog('failed to remove user(' + user + ') from tenant(' + tenant + ').');
+		return false;
+	}
+
+	return true;
+}
+
+//	tenant		: tenant name
+//	user		: user name
+//	id			: tenant id
+//
+//	result		{
+//					result:			true/false
+//					message:		null or error message
+//				}
+//
+function rawRemoveUserFromLocalTenant(tenant, user, id)
+{
+	var	resobj = {result: true, message: null};
+
+	if(!apiutil.isSafeStrings(tenant, user, id)){
 		resobj.result	= false;
-		resobj.message	= 'failed to remove tenant(' + tenant + ') from user(' + user + ').';
+		resobj.message	= 'some parameters are wrong : tenant=' + JSON.stringify(tenant) + ', user=' + JSON.stringify(user) + ', id=' + JSON.stringify(id);
+		r3logger.elog(resobj.message);
+		return resobj;
+	}
+
+	var	dkcobj			= k2hdkc(dkcconf, dkcport, dkccuk, true, false);			// use permanent object(need to clean)
+	if(!rawInitKeyHierarchy(dkcobj)){
+		resobj.result	= false;
+		resobj.message	= 'Not initialize yet, or configuration is not set';
 		r3logger.elog(resobj.message);
 		dkcobj.clean();
 		return resobj;
 	}
 
-	//
-	// Remove user from tenant
-	//
-	if(!rawRemoveUserFromTenant(dkcobj, tenant, user)){
+	if(!rawRemoveUserFromLocalTenantEx(dkcobj, tenant, user, id)){
 		resobj.result	= false;
-		resobj.message	= 'failed to remove user(' + user + ') from tenant(' + tenant + ').';
+		resobj.message	= 'could not remove user(' + JSON.stringify(user) + ') from tenant(' + JSON.stringify(tenant) + '), id(' + JSON.stringify(id) + ').';
 		r3logger.elog(resobj.message);
 		dkcobj.clean();
 		return resobj;
@@ -2387,14 +2520,14 @@ function rawAddTenantToExistedUser(dkcobj_permanent, user, tenant)
 //	id				: tenant id, if user is specified(service is specified, do not need this)
 //	desc			: tenant description, if user is specified(service is specified, do not need this)
 //	display			: display name, if user is specified(service is specified, do not need this)
-//	other_users		: other users in this tenant (this parameter is invalid if service is specified)
+//	tenant_users	: tenant users in this tenant (this parameter is invalid if service is specified)
 //
 // [NOTE]
 // Both user and service can not be specified at same time.
 // This function create keys without resource/policy/role, you must be careful for service
 // case.
 //
-function rawCreateTenantEx(dkcobj_permanent, user, tenant, service, id, desc, display, other_users)
+function rawCreateTenantEx(dkcobj_permanent, user, tenant, service, id, desc, display, tenant_users)
 {
 	if(!(dkcobj_permanent instanceof Object) || !dkcobj_permanent.isPermanent()){
 		r3logger.elog('parameter dkcobj_permanent is not object or not permanent');
@@ -2420,10 +2553,10 @@ function rawCreateTenantEx(dkcobj_permanent, user, tenant, service, id, desc, di
 		}
 		service	= null;
 
-		if(apiutil.isEmptyArray(other_users)){
-			other_users = [];
+		if(apiutil.isEmptyArray(tenant_users)){
+			r3logger.elog('parameter is wrong : tenant_users=' + JSON.stringify(tenant_users));
+			return false;
 		}
-		apiutil.tryAddStringToArray(other_users, user);		// add user to other_users
 
 	}else if(apiutil.isSafeString(service) && !apiutil.isSafeString(user)){
 		//
@@ -2431,7 +2564,7 @@ function rawCreateTenantEx(dkcobj_permanent, user, tenant, service, id, desc, di
 		//
 		service		= service.toLowerCase();
 		user		= null;
-		other_users	= null;
+		tenant_users= null;
 	}else{
 		r3logger.elog('some parameters are wrong(both are empty or not empty) : service=' + JSON.stringify(service) + ', user=' + JSON.stringify(user));
 		return false;
@@ -2661,32 +2794,42 @@ function rawCreateTenantEx(dkcobj_permanent, user, tenant, service, id, desc, di
 		}
 
 		//
-		// Add other users(with user) to tenant
+		// Add tenant users to tenant
 		//
-		if(!apiutil.isEmptyArray(other_users)){
-			var	need_update_user_key = false;
-			for(var cnt = 0; cnt < other_users.length; ++cnt){
-				// add one other user
-				var	added_other_user = rawAddTenantToExistedUser(dkcobj_permanent, other_users[cnt], tenant);
-				if(!apiutil.isSafeString(added_other_user)){
-					continue;
-				}
-				// check new adding user
-				if(apiutil.tryAddStringToArray(user_subkeylist, added_other_user)){
-					user_subkeylist.sort();
-					need_update_user_key = true;
-				}
+		var	new_user_subkeylist = [];
+		for(var cnt = 0; cnt < tenant_users.length; ++cnt){
+			// add one tenant user
+			var	added_other_user = rawAddTenantToExistedUser(dkcobj_permanent, tenant_users[cnt], tenant);
+			if(!apiutil.isSafeString(added_other_user)){
+				continue;
 			}
-			//
-			// Re-update user key in tenant
-			//
-			if(need_update_user_key){
-				if(!dkcobj_permanent.setSubkeys(keys.TENANT_USER_KEY, user_subkeylist)){	// add subkey yrn:yahoo::::user:<user> -> yrn:yahoo:::<tenant>:user
-					r3logger.elog('could not add ' + keys.USER_KEY + ' subkey under ' + keys.TENANT_USER_KEY + ' key');
-					return false;
-				}
+			// check new adding user
+			if(apiutil.tryAddStringToArray(new_user_subkeylist, added_other_user)){
+				new_user_subkeylist.sort();
 			}
 		}
+
+		//
+		// Delete tenant users
+		//
+		for(cnt = 0; cnt < user_subkeylist.length; ++cnt){
+			if(apiutil.findStringInArray(new_user_subkeylist, user_subkeylist[cnt])){
+				continue;
+			}
+			// user does not in new tenant users
+			var	delete_user_name = user_subkeylist[cnt].replace(keys.USER_TOP_KEY + ':', '');
+			if(!rawRemoveUserFromLocalTenantEx(dkcobj_permanent, tenant, delete_user_name, id)){
+				r3logger.elog('could not delete user(' + delete_user_name + ') from tenant(' + tenant + '), id(' + id + '), but continue...');
+			}
+		}
+
+		//
+		// Re-update user key in tenant(always update...)
+		//
+		if(!dkcobj_permanent.setSubkeys(keys.TENANT_USER_KEY, new_user_subkeylist)){	// add subkey yrn:yahoo::::user:<user> -> yrn:yahoo:::<tenant>:user
+			r3logger.elog('could not add ' + keys.USER_KEY + ' subkey under ' + keys.TENANT_USER_KEY + ' key');
+			return false;
+		}
 	}
 
 	//
@@ -2856,13 +2999,14 @@ function rawCheckTenantEnable(dkcobj_permanent, tenant, servicename)
 //	id				: tenant id
 //	desc			: tenant description
 //	display			: display name
-//	other_users		: other users in this tenant (this parameter is invalid if service is specified)
+//	tenant_users	: tenant users in this tenant (this parameter is invalid if service is specified)
+//	is_replace_users: replace with tenant_users if this flag is true (default). if false, tenant_users will be added.
 //
 // [NOTE]
 // This function does not check the user is a member in tenant, then 
 // you must check it before calling this function.
 //
-function rawCreateTenant(user, tenant, id, desc, display, other_users)
+function rawCreateTenant(user, tenant, id, desc, display, tenant_users, is_replace_users)
 {
 	var	resobj = {result: true, message: null};
 
@@ -2884,6 +3028,19 @@ function rawCreateTenant(user, tenant, id, desc, display, other_users)
 		// to string
 		id = String(id);
 	}
+	if(!apiutil.isArray(tenant_users) && !apiutil.isSafeString(tenant_users)){
+		// tenant_users must be array or string
+		//
+		resobj.result	= false;
+		resobj.message	= 'parameter is wrong : tenant_users=' + JSON.stringify(tenant_users);
+		r3logger.elog(resobj.message);
+		return resobj;
+	}else if(!apiutil.isArray(tenant_users)){
+		tenant_users = [tenant_users];
+	}
+	if('boolean' !== typeof is_replace_users){
+		is_replace_users = true;
+	}
 
 	var	dkcobj			= k2hdkc(dkcconf, dkcport, dkccuk, true, false);					// use permanent object(need to clean)
 	if(!rawInitKeyHierarchy(dkcobj)){
@@ -2894,10 +3051,19 @@ function rawCreateTenant(user, tenant, id, desc, display, other_users)
 		return resobj;
 	}
 
+	if(!is_replace_users){
+		var	findobj = rawFindTenantEx(dkcobj, tenant, user, id);
+		if(apiutil.isSafeEntity(findobj)){
+			// found tenant
+			tenant_users = apiutil.mergeArray(tenant_users, apiutil.getSafeArray(findobj.users));
+			tenant_users.sort();
+		}
+	}
+
 	//
 	// Create tenant top
 	//
-	if(!rawCreateTenantEx(dkcobj, user, tenant, null, id, desc, display, other_users)){
+	if(!rawCreateTenantEx(dkcobj, user, tenant, null, id, desc, display, tenant_users)){
 		resobj.result	= false;
 		resobj.message	= 'could not create tenant(' + tenant + ') with id(' + id + '), desc(' + JSON.stringify(desc) + '), display(' + JSON.stringify(display) + '), user(' + user + ')';
 		r3logger.elog(resobj.message);
@@ -11783,12 +11949,12 @@ function rawCompareChildrenListName(child1, child2)
 //
 // These functions initializing tenant is without service.
 //
-exports.initTenant = function(tenantname, id, desc, display, user, other_users)
+exports.initTenant = function(tenantname, id, desc, display, user, tenant_users)
 {
 	//
 	// Must initialize service key before calling this if specified service parameter
 	//
-	return rawCreateTenant(user, tenantname, id, desc, display, other_users);
+	return rawCreateTenant(user, tenantname, id, desc, display, tenant_users, true);
 };
 
 exports.initUser = function(user, id, username, tenant)
@@ -11801,7 +11967,7 @@ exports.initUserTenant = function(user, userid, username, tenant, tenantid, tena
 	//
 	// Must initialize service key before calling this if specified service parameter
 	//
-	var	resobj = rawCreateTenant(user, tenant, tenantid, tenantdesc, tenantdisplay);
+	var	resobj = rawCreateTenant(user, tenant, tenantid, tenantdesc, tenantdisplay, user, false);
 	if(resobj.result){
 		resobj = rawCreateUser(user, userid, username, tenant);
 	}
@@ -11823,6 +11989,11 @@ exports.removeUserFromLocalTenant = function(tenant, user, id)
 	return rawRemoveUserFromLocalTenant(tenant, user, id);
 };
 
+exports.removeLocalTenant = function(tenant, user, id)
+{
+	return rawRemoveLocalTenant(tenant, user, id);
+};
+
 exports.getUserId = function(username)
 {
 	return rawGetUserId(username);

package/lib/k2hr3tokens.js

@@ -639,16 +639,19 @@ function rawRemoveScopedUserToken(token)
 // 
 // result		:	null or token information
 //					{
-//						role:		role name
-//						user:		user name
-//						hostname:	always null
-//						ip:			always null
-//						port:		always 0
-//						cuk:		always null
-//						extra:		always null
-//						tenant:		tenant name
-//						scoped:		role token is always scoped(true)
-//						region:		when user token, the creator region name of the token
+//						role:			role name
+//						user:			user name
+//						hostname:		always null
+//						ip:				always null
+//						port:			always 0
+//						cuk:			always null
+//						extra:			always null
+//						tenant:			tenant name
+//						display:		display alias name for tenant
+//						id:				tenant id string
+//						description:	description for tenant
+//						scoped:			role token is always scoped(true)
+//						region:			when user token, the creator region name of the token
 //					}
 // 
 function rawCheckUserToken(token)
@@ -1747,16 +1750,19 @@ function rawGetDirectRoleTokenInfo(dkcobj_permanent, tokens)
 // 
 // result		:	null or token information
 //					{
-//						role:		role name
-//						user:		null or user name
-//						hostname:	null or host name
-//						ip:			null or ip address
-//						port:		port number(if host is existed), 0 means any
-//						cuk:		cuk(allowed null)
-//						extra:		extra(allowed null)
-//						tenant:		tenant name
-//						scoped:		role token is always scoped(true)
-//						region:		role token is always null
+//						role:			role name
+//						user:			null or user name
+//						hostname:		null or host name
+//						ip:				null or ip address
+//						port:			port number(if host is existed), 0 means any
+//						cuk:			cuk(allowed null)
+//						extra:			extra(allowed null)
+//						tenant:			tenant name
+//						display:		display alias name for tenant
+//						id:				tenant id string
+//						description:	description for tenant
+//						scoped:			role token is always scoped(true)
+//						region:			role token is always null
 //					}
 // 
 function rawCheckRoleToken(token, ip, port, cuk, is_strict)
@@ -1828,6 +1834,12 @@ function rawCheckRoleToken(token, ip, port, cuk, is_strict)
 		return null;
 	}
 
+	// Get tenant information
+	var	tenant_keys		= r3keys(null, value.tenant);
+	value.display		= apiutil.getSafeString(dkcobj.getValue(tenant_keys.TENANT_DISP_KEY, null, true, null));
+	value.id			= apiutil.getSafeString(dkcobj.getValue(tenant_keys.TENANT_ID_KEY, null, true, null));
+	value.description	= apiutil.getSafeString(dkcobj.getValue(tenant_keys.TENANT_DESC_KEY, null, true, null));
+
 	// compare ip address, if they are specified and token is not created by user
 	if(!apiutil.isSafeString(value.user)){
 		if(!apiutil.isSafeString(ip) || ip !== value.ip){
@@ -1909,17 +1921,20 @@ function rawCheckRoleToken(token, ip, port, cuk, is_strict)
 	}
 
 	// make result
-	var	token_info		= {};
-	token_info.role		= value.role;
-	token_info.user		= value.user;
-	token_info.hostname	= value.hostname;													// hostname
-	token_info.ip		= value.ip;
-	token_info.port		= value.port;
-	token_info.cuk		= value.cuk;
-	token_info.extra	= value.extra;
-	token_info.tenant	= value.tenant;
-	token_info.scoped	= true;																// role token is always scoped
-	token_info.region	= null;
+	var	token_info			= {};
+	token_info.role			= value.role;
+	token_info.user			= value.user;
+	token_info.hostname		= value.hostname;												// hostname
+	token_info.ip			= value.ip;
+	token_info.port			= value.port;
+	token_info.cuk			= value.cuk;
+	token_info.extra		= value.extra;
+	token_info.tenant		= value.tenant;
+	token_info.display		= value.display;
+	token_info.id			= value.id;
+	token_info.description	= value.description;
+	token_info.scoped		= true;															// role token is always scoped
+	token_info.region		= null;
 
 	return token_info;
 }
@@ -2152,10 +2167,19 @@ function rawGetUserTenantByToken(token)
 		dkcobj.clean();
 		return null;
 	}
-	var	username	= apiutil.getSafeString(matches[1]);
-	var	tenantname	= apiutil.getSafeString(matches[2]);
-	if('' === tenantname){
-		tenantname	= null;
+	var	user_name		= apiutil.getSafeString(matches[1]);
+	var	tenant_name		= apiutil.getSafeString(matches[2]);
+	var	tenant_display	= null;
+	var	tenant_id		= null;
+	var	tenant_desc		= null;
+
+	if('' === tenant_name){
+		tenant_name		= null;
+	}else{
+		var	tenant_keys	= r3keys(user_name, tenant_name);
+		tenant_display	= apiutil.getSafeString(dkcobj.getValue(tenant_keys.TENANT_DISP_KEY, null, true, null));
+		tenant_id		= apiutil.getSafeString(dkcobj.getValue(tenant_keys.TENANT_ID_KEY, null, true, null));
+		tenant_desc		= apiutil.getSafeString(dkcobj.getValue(tenant_keys.TENANT_DESC_KEY, null, true, null));
 	}
 
 	// if token has seed, need to check seed
@@ -2168,20 +2192,21 @@ function rawGetUserTenantByToken(token)
 		//
 		//r3logger.dlog('token key(' + user_token_key + ') has seed.');
 
-		var	vres = osapi.verifyUserToken(username, tenantname, token, token_seed);
+		var	vres = osapi.verifyUserToken(user_name, tenant_name, token, token_seed);
 		if(!vres.result){
 			r3logger.elog('failed to verify token(' + token + ') with seed by ' + vres.message);
 			return null;
 		}
 	}
 
-	/* eslint-disable indent, no-mixed-spaces-and-tabs */
 	var	result	= {
-					user:	username,
-					tenant:	tenantname,
-					region:	region
-				  };
-	/* eslint-enable indent, no-mixed-spaces-and-tabs */
+		user:			user_name,
+		tenant:			tenant_name,
+		display:		tenant_display,
+		id:				tenant_id,
+		description:	tenant_desc,
+		region:			region
+	};
 
 	return result;
 }
@@ -2191,8 +2216,10 @@ function rawGetUserTenantByToken(token)
 //---------------------------------------------------------
 //	result		[
 //					{
-//						name:		"tenant name",				=> tenant name which is "key" in k2hdkc
-//						display:	"display tenant name"		=> display alias name for tenant
+//						name:			"tenant name",			=> tenant name which is "key" in k2hdkc
+//						display:		"display tenant name"	=> display alias name for tenant
+//						id:				"tenant id"				=> tenant id string
+//						description:	"tenant description"	=> description for tenant
 //					},
 //					...
 //				]
@@ -2245,13 +2272,15 @@ function rawGetTenantListByUserWithDkc(dkcobj_permanent, user)
 	var	tenant_list			= new Array(0);
 	for(cnt = 0; cnt < name_list.length; ++cnt){
 		var	tenant_keys		= r3keys(user, name_list[cnt]);
-		var	display_name	= dkcobj_permanent.getValue(tenant_keys.TENANT_DISP_KEY, null, true, null);
-		if(!apiutil.isSafeEntity(display_name)){
-			display_name = '';
-		}
+		var	tenant_display	= apiutil.getSafeString(dkcobj_permanent.getValue(tenant_keys.TENANT_DISP_KEY, null, true, null));
+		var	tenant_id		= apiutil.getSafeString(dkcobj_permanent.getValue(tenant_keys.TENANT_ID_KEY, null, true, null));
+		var	tenant_desc		= apiutil.getSafeString(dkcobj_permanent.getValue(tenant_keys.TENANT_DESC_KEY, null, true, null));
+
 		tenant_list.push({
 			name:			name_list[cnt],
-			display:		display_name
+			display:		tenant_display,
+			id:				tenant_id,
+			description:	tenant_desc
 		});
 	}
 
@@ -2260,8 +2289,10 @@ function rawGetTenantListByUserWithDkc(dkcobj_permanent, user)
 
 //	result		[
 //					{
-//						name:		"tenant name",				=> tenant name which is "key" in k2hdkc
-//						display:	"display tenant name"		=> display alias name for tenant
+//						name:			"tenant name",			=> tenant name which is "key" in k2hdkc
+//						display:		"display tenant name"	=> display alias name for tenant
+//						id:				"tenant id"				=> tenant id string
+//						description:	"tenant description"	=> description for tenant
 //					},
 //					...
 //				]
@@ -2429,15 +2460,18 @@ function rawCheckTenantInTenantList(tenants, tenant)
 //
 // token is following:
 //					{
-//						role:		role name
-//						user:		null or user name
-//						hostname:	null or host name
-//						ip:			null or host ip address
-//						port:		port number(if host is existed), 0 means any
-//						cuk:		cuk(allowed null)
-//						extra:		extra(allowed null)
-//						tenant:		tenant name
-//						scoped:		role token is always scoped(true)
+//						role:			role name
+//						user:			null or user name
+//						hostname:		null or host name
+//						ip:				null or host ip address
+//						port:			port number(if host is existed), 0 means any
+//						cuk:			cuk(allowed null)
+//						extra:			extra(allowed null)
+//						tenant:			tenant name
+//						display:		display alias name for tenant
+//						id:				tenant id string
+//						description:	description for tenant
+//						scoped:			role token is always scoped(true)
 //					}
 
 function rawCheckToken(req, is_scoped, is_user)