3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-06 10:21:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

also filter groups from IdP claim

Browse source
This commit is contained in:
Kenneth Jenkins 2025-01-23 15:07:43 -08:00
parent d7beb36844
commit 596bec9b9b
2 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
authorize/evaluator/headers_evaluator_evaluation.go
View file

@ -334,6 +334,7 @@ func (e *headersEvaluatorEvaluation) getGroups(ctx context.Context) []string {
s, _ := e.getSessionOrServiceAccount(ctx) s, _ := e.getSessionOrServiceAccount(ctx)
groups, _ := getClaimStringSlice(s, "groups") groups, _ := getClaimStringSlice(s, "groups")
groups = e.filterGroups(groups)
return groups return groups
} }

12
authorize/evaluator/headers_evaluator_test.go
View file

@ -490,6 +490,12 @@ func TestHeadersEvaluator_JWTGroupsFilter(t *testing.T) {
newDirectoryUserRecord(directory.User{ID: id, GroupIDs: groups}), newDirectoryUserRecord(directory.User{ID: id, GroupIDs: groups}),
) )
} }
// Also add a user session with an upstream "groups" claim from the IdP.
records = append(records,
&session.Session{Id: "SESSION-11", UserId: "USER-11", Claims: map[string]*structpb.ListValue{
"groups": newList("foo", "bar", "baz"),
}},
)
cases := []struct { cases := []struct {
name string name string
@ -511,6 +517,7 @@ func TestHeadersEvaluator_JWTGroupsFilter(t *testing.T) {
"no filtering", nil, nil, "SESSION-10", "no filtering", nil, nil, "SESSION-10",
[]any{"10", "20", "30", "40", "50", "GROUP-10", "GROUP-20", "GROUP-30", "GROUP-40", "GROUP-50"}, []any{"10", "20", "30", "40", "50", "GROUP-10", "GROUP-20", "GROUP-30", "GROUP-40", "GROUP-50"},
}, },
{"groups claim", []string{"foo", "quux"}, nil, "SESSION-11", []any{"foo"}},
} }
ctx := storage.WithQuerier(context.Background(), storage.NewStaticQuerier(records...)) ctx := storage.WithQuerier(context.Background(), storage.NewStaticQuerier(records...))
@ -589,3 +596,8 @@ func newDirectoryUserRecord(directoryUser directory.User) *databroker.Record {
s, _ := structpb.NewStruct(m) s, _ := structpb.NewStruct(m)
return storage.NewStaticRecord(directory.UserRecordType, s) return storage.NewStaticRecord(directory.UserRecordType, s)
} }
func newList(v ...any) *structpb.ListValue {
lv, _ := structpb.NewList(v)
return lv
}