4 commits

Author	SHA1	Message	Date
Kenneth Jenkins	21b9e7890c	authorize: add filter options for JWT groups (#5417) ... Add a new option for filtering to a subset of directory groups in the Pomerium JWT and Impersonate-Group headers. Add a JWTGroupsFilter field to both the Options struct (for a global filter) and to the Policy struct (for per-route filter). These will be populated only from the config protos, and not from a config file. If either filter is set, then for each of a user's groups, the group name or group ID will be added to the JWT groups claim only if it is an exact string match with one of the elements of either filter.	2025-01-08 13:57:57 -08:00
Caleb Doxsey	fb7b61a677	cleanup headers (#5408) ... * cleanup headers * return issuer format errors * go mod	2025-01-06 09:52:29 -07:00
Kenneth Jenkins	683c5a2eac	authorize: change handling of empty groups claim (#5394) ... Make sure to serialize the JWT "groups" claim as an empty list rather than a JSON null. This matches the behavior of Pomerium v0.27.2 and earlier, and should provide better compatibility with some third-party libraries.	2024-12-11 12:55:04 -08:00
Caleb Doxsey	37017e2a5b	authorize: rewrite header evaluator to use go instead of rego (#5362) ... * authorize: rewrite header evaluator to use go instead of rego * cache signed jwt * re-add missing trace * address comments	2024-11-07 13:07:16 -07:00