Support for regex pattern in DefaultJWTClaimMapper permission parser #7574
Conversation
|
|
common/config/config.go
Outdated
| @@ -577,6 +577,7 @@ type ( | |||
| // Signing key provider for validating JWT tokens | |||
| JWTKeyProvider JWTKeyProvider `yaml:"jwtKeyProvider"` | |||
| PermissionsClaimName string `yaml:"permissionsClaimName"` | |||
| PermissionsPattern string `yaml:"permissionsPattern"` | |||
There was a problem hiding this comment.
nit: consider calling this PermissionsRegex to clearly indicate what the contents should be and update the naming throughout.
There was a problem hiding this comment.
@captainbeardo Thank you, done.
There was a problem hiding this comment.
LGTM. Could you also open a PR to document this in our documentation repo: https://github.com/temporalio/documentation/blob/main/docs/production-deployment/self-hosted-guide/security.mdx#default-jwt-claimmapper?
@bergundy, will do that! Thanks, appreciate the support! |
What changed?
Added support for parsing permissions from JWT claim using regular expression
Why?
Default JWT Claim Mapper expects permission in form
namespace:role. If it's not possible to configure JWT issuer to follownamespace:rolepermissionsPattern can be set to regular expression with named groups to parse permission. More details in issue gh-7560How did you test it?
Potential risks
This change is only activated if new configuration is provided
Documentation
WIP
Is hotfix candidate?
No