oid_introspection: add SetOIDCClaims #3311
Conversation
This method allows third-party filters to set the oidcClaimsCacheKey which enables the use of the oidcClaimsQuery filter. Signed-off-by: Adrien Surée <adrien.suree@zalando.de>
haveo
force-pushed
the
make-token-container
branch
from
4a0c06c
to
c893a51
Compare
filters/auth/oidc_introspection.go
Outdated
| @@ -42,6 +42,12 @@ func NewOIDCQueryClaimsFilter() filters.Spec { | |||
| } | |||
| } | |||
|
|
|||
| func MakeTokenContainer(h map[string]interface{}) tokenContainer { | |||
There was a problem hiding this comment.
Its an exported method that returns non-exported type - not good.
The original issue was:
However, when working with a third-party filter, it is not possible to create a tokenContainer value because this type is private to the filters/auth package. Therefore it is not possible to set the OIDC claims cache key to a value that would be accepted by oidcClaimsQuery, since the filter expects a value of type tokenContainer to be stored there.
This prevents the reuse of oidcClaimsQuery when the authentication is done in a third-party filter.
and proposed solution:
A function should be exported that sets the OIDC claims cache key (given a map[string]interface{} claims value).
But this change does not implement the proposal - user of MakeTokenContainer still needs to rely on a known value of statebag key.
I think the proper change should provide an utility to store token container into statebag, it should be documented and existing code should be changed to use it.
There was a problem hiding this comment.
You're right, I remembered incorrectly what I was supposed to implement. I'll change it to what was proposed in the issue.
There was a problem hiding this comment.
"existing code should be changed to use it" do you mean the auth filters in skipper that store the token container in the statebag should use this new method? They wouldn't be able to do that with the proposed interface since they store more than just claims. But on the other hand it doesn't seem like any field other than claims is used when reading from the statebag.
haveo
changed the title
Signed-off-by: Adrien Surée <adrien.suree@zalando.de>
haveo
force-pushed
the
make-token-container
branch
from
a2c324c
to
4f4de08
Compare
This method allows third-party filters to set the oidcClaimsCacheKey which enables the use of the oidcClaimsQuery filter.
Closes #3139