config: support map of jwt claim headers (#1906)

* config: support map of jwt claim headers

* fix array handling, add test

* update docs

* use separate hook, add tests

authorize/check_response_test.go

@@ -33,7 +33,7 @@ func TestAuthorize_okResponse(t *testing.T) {
 				Rego: []string{"allow = true"},
 			}},
 		}},
-		JWTClaimsHeaders: []string{"email"},
+		JWTClaimsHeaders: config.NewJWTClaimHeaders("email"),
 	}
 	a := &Authorize{currentOptions: config.NewAtomicOptions(), state: newAtomicAuthorizeState(new(authorizeState))}
 	encoder, _ := jws.NewHS256Signer([]byte{0, 0, 0, 0})

authorize/evaluator/opa/policy/authz.rego

@@ -262,11 +262,12 @@ identity_headers := {key: value |
 		claim_value != null
 
 		# only include those headers requested by the user
-		available := data.jwt_claim_headers[_]
+		some header_name
+		available := data.jwt_claim_headers[header_name]
 		available == claim_key
 
 		# create the header key and value
-		k := concat("", ["x-pomerium-claim-", claim_key])
+		k := header_name
 		v := get_header_string_value(claim_value)
 	]
 

authorize/evaluator/opa_test.go

@@ -39,7 +39,7 @@ func TestOPA(t *testing.T) {
 		require.NoError(t, err)
 		store := NewStoreFromProtos(data...)
 		store.UpdateIssuer("authenticate.example.com")
-		store.UpdateJWTClaimHeaders([]string{"email", "groups", "user"})
+		store.UpdateJWTClaimHeaders(config.NewJWTClaimHeaders("email", "groups", "user"))
 		store.UpdateRoutePolicies(policies)
 		store.UpdateSigningKey(privateJWK)
 		r := rego.New(

authorize/evaluator/store.go

@@ -102,7 +102,7 @@ func (s *Store) UpdateGoogleCloudServerlessAuthenticationServiceAccount(serviceA
 }
 
 // UpdateJWTClaimHeaders updates the jwt claim headers in the store.
-func (s *Store) UpdateJWTClaimHeaders(jwtClaimHeaders []string) {
+func (s *Store) UpdateJWTClaimHeaders(jwtClaimHeaders map[string]string) {
 	s.write("/jwt_claim_headers", jwtClaimHeaders)
 }