3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-31 07:19:16 +02:00
Code Issues Projects Releases Packages Wiki Activity

also filter groups from IdP claim

Browse source
This commit is contained in:
Kenneth Jenkins 2025-01-23 15:07:43 -08:00
parent d7beb36844
commit 596bec9b9b
2 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
authorize/evaluator/headers_evaluator_test.go
View file

@ -490,6 +490,12 @@ func TestHeadersEvaluator_JWTGroupsFilter(t *testing.T) {
newDirectoryUserRecord(directory.User{ID: id, GroupIDs: groups}),
)
}
// Also add a user session with an upstream "groups" claim from the IdP.
records = append(records,
&session.Session{Id: "SESSION-11", UserId: "USER-11", Claims: map[string]*structpb.ListValue{
"groups": newList("foo", "bar", "baz"),
}},
)
cases := []struct {
name string
@ -511,6 +517,7 @@ func TestHeadersEvaluator_JWTGroupsFilter(t *testing.T) {
"no filtering", nil, nil, "SESSION-10",
[]any{"10", "20", "30", "40", "50", "GROUP-10", "GROUP-20", "GROUP-30", "GROUP-40", "GROUP-50"},
},
{"groups claim", []string{"foo", "quux"}, nil, "SESSION-11", []any{"foo"}},
}
ctx := storage.WithQuerier(context.Background(), storage.NewStaticQuerier(records...))
@ -589,3 +596,8 @@ func newDirectoryUserRecord(directoryUser directory.User) *databroker.Record {
s, _ := structpb.NewStruct(m)
return storage.NewStaticRecord(directory.UserRecordType, s)
}
func newList(v ...any) *structpb.ListValue {
lv, _ := structpb.NewList(v)
return lv
}