refactor(oidc): Use jmespath to extract roles from claims #9115

rhafer · 2024-05-08T15:48:16Z

Instead of using our own custom implementation for walking the claims, we now use jmespath query language to extract roles from the claims. This allows a more flexible specification of how to map claims to roles. The drawback being that the way that escaping rules for claim name containing dots (.) will change.

This is a bit of a test balloon to get some feedback. Ideally would also allow jmespath queries for the other OIDC claims that we allow to be configured (basically the autoprovisioning attributes and PROXY_USER_OIDC_CLAIM value)

Would also raise the question with jmespath implemenation we should use there is https://github.com/jmespath/go-jmespath and https://github.com/jmespath-community/go-jmespath. I picked the first because we already had it vendored via some other dependency. (The latter one seems to be more uptodate though)

Instead of use our own custom implementation for walking the claims, we now use jmespath query language to extract roles from the claims. This allows a more flexible specification of how to map claims to roles. The drawback being that the way that escaping rules for claim name containing dots (`.`) will change.

update-docs · 2024-05-08T15:48:21Z

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.