Support catalogue restriction through nested claims

未关闭
  • 哪里不对？
#497 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
停滞
技术栈
java
领域
authorization, backend-api-design

调研方向

首先定位 Onyxia API 中对 service-catalogue restriction 的处理以及 JWT root-claim 的评估。选择 nested-claim 结构之前，先查看现有 restriction 配置是如何表示的。Done 应包括任意嵌套、匹配嵌套列表中的值、对句点安全的 map 键，以及不破坏现有配置。

由索引模型根据 Issue 内容生成。

描述

Currently access to service catalogues can only be restricted based on root claims in the JWT. In some cases it would be useful to restrict access based on some nested property in the token.

E.g. we have a custom claim:

{
  "custom": {
    "custom2": {
      "someList": [ "a", "b" ]
    }
  }
}

And would like to restrict access to a catalogue based on the presence of an item in custom.someList (this could be a list of access groups a user is in, for example).

Of course, periods are valid characters in a map key, so some thought will have to be given to how this is handled. In addition, arbitrary amounts of nesting should be supported, and it should not break existing configurations of Onyxia.. Perhaps something similar to this could work:

"restrictions": [
  {
    "userAttribute": {
      "subAttribute": ["custom", "custom2"]
      "key": "someList",
      "matches": "b"
    }
  }
]

where subAttribute is an ordered list of attributes to traverse through in the JWT. Another way could be to use some nested object,

"restrictions": [
  {
    "nestedUserAttribute": {
      "key": "custom",
      "nestedUserAttribute": {
        "key": "custom2",
        "userAttribute": {
          "key": "someList",
          "matches": "b"
        }
      }
    }
  }
]

These are of course just suggestions off the top of my head, there are probably much better ways of solving it 😀

主要语言
Java
星标
34
派生
34
平均合并
9 分钟
30 天内合并 PR
4

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

InseeFrLab/onyxia-api 的其他 Issue

查看 InseeFrLab/onyxia-api 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。