3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-02 02:42:57 +02:00
Code Issues Projects Releases Packages Wiki Activity

authorize: add filter options for JWT groups (#5417)

Browse source 
Add a new option for filtering to a subset of directory groups in the
Pomerium JWT and Impersonate-Group headers. Add a JWTGroupsFilter field
to both the Options struct (for a global filter) and to the Policy
struct (for per-route filter). These will be populated only from the
config protos, and not from a config file.

If either filter is set, then for each of a user's groups, the group
name or group ID will be added to the JWT groups claim only if it is an
exact string match with one of the elements of either filter.
This commit is contained in:
Kenneth Jenkins 2025-01-08 13:57:57 -08:00 • committed by GitHub
parent 95d4a24271
commit 21b9e7890c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
13 changed files with 834 additions and 620 deletions
Download patch file Download diff file Expand all files Collapse all files

6
config/options_test.go
View file

@ -1436,6 +1436,9 @@ func TestRoute_FromToProto(t *testing.T) {
pb.From = "https://" + randomDomain()
// EnvoyOpts is set to an empty non-nil message during conversion, if nil
pb.EnvoyOpts = &envoy_config_cluster_v3.Cluster{}
// JWT groups filter order is not significant. Upon conversion back to
// a protobuf the JWT groups will be sorted.
slices.Sort(pb.JwtGroupsFilter)
switch mathrand.IntN(3) {
case 0:
@ -1536,6 +1539,9 @@ func TestOptions_FromToProto(t *testing.T) {
unsetFalseOptionalBoolFields(settings)
fixZeroValuedEnums(settings)
generateCertificates(t, settings)
// JWT groups filter order is not significant. Upon conversion back to
// a protobuf the JWT groups will be sorted.
slices.Sort(settings.JwtGroupsFilter)
return settings
}