3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-03 16:59:22 +02:00
Code Issues Projects Releases Packages Wiki Activity

core/kubernetes: fix impersonate group header (#5090)

Browse source 
* core/kubernetes: fix impersonate group header

* formatting
This commit is contained in:
Caleb Doxsey 2024-04-26 15:26:41 -06:00 • committed by GitHub
parent 99a5dbd65b
commit 8b3a79152b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
authorize/evaluator/opa/policy/headers.rego
View file

@ -174,11 +174,12 @@ signed_jwt := io.jwt.encode_sign(jwt_headers, jwt_payload, data.signing_key)
kubernetes_headers := h if {
input.kubernetes_service_account_token != ""
h := [
h := remove_empty_header_values([
["Authorization", concat(" ", ["Bearer", input.kubernetes_service_account_token])],
["Impersonate-User", jwt_payload_email],
["Impersonate-Group", get_header_string_value(jwt_payload_groups)],
]
])
} else := []
google_cloud_serverless_authentication_service_account := s if {
@ -267,3 +268,10 @@ get_header_string_value(obj) := s if {
} else := s if {
s := concat(",", [obj])
}
remove_empty_header_values(arr) := [[k, v] |
some idx
k := arr[idx][0]
v := arr[idx][1]
v != ""
]