Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor(oidc): Use jmespath to extract roles from claims #9115

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

rhafer
Copy link
Contributor

@rhafer rhafer commented May 8, 2024

Instead of using our own custom implementation for walking the claims, we now use jmespath query language to extract roles from the claims. This allows a more flexible specification of how to map claims to roles. The drawback being that the way that escaping rules for claim name containing dots (.) will change.

This is a bit of a test balloon to get some feedback. Ideally would also allow jmespath queries for the other OIDC claims that we allow to be configured (basically the autoprovisioning attributes and PROXY_USER_OIDC_CLAIM value)

Would also raise the question with jmespath implemenation we should use there is https://github.com/jmespath/go-jmespath and https://github.com/jmespath-community/go-jmespath. I picked the first because we already had it vendored via some other dependency. (The latter one seems to be more uptodate though)

Instead of use our own custom implementation for walking the claims, we now use jmespath
query language to extract roles from the claims. This allows a more flexible specification
of how to map claims to roles. The drawback being that the way that escaping rules for claim
name containing dots (`.`) will change.
Copy link

update-docs bot commented May 8, 2024

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

Copy link

sonarcloud bot commented May 8, 2024

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant