Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

question: issuing custom claims dynamically #68

Open
zhirschtritt opened this issue Mar 7, 2022 · 3 comments
Open

question: issuing custom claims dynamically #68

zhirschtritt opened this issue Mar 7, 2022 · 3 comments
Assignees
@greenpau
Labels
authorization feature pending user response

Comments

@zhirschtritt
Copy link

zhirschtritt commented Mar 7, 2022 •
edited
Loading

To preface, this is probably a feature request and likely a non-trivial one, but I thought I'd figure out if it's actually a reasonable request.

I would like to use the auth plugin to issue roles based on a call to my backend service or some other shared crud-y resource that caddy can read and my app can update. I want to be able to edit authorized users on the fly and apply roles/custom claims without having to edit the Caddyfile.

I'm guessing this is outside of scope for this project, but wondering what your thoughts are on a feature like this.

Edit: On further reading of other issues, I see I'm not the first person to bring this up. I also see #16 which is related to my request. Here's what I'm imagining a auth flow might look like:

  • User authenticates with some OAuth2 provider
  • caddy-auth sends JWT to endpoint specified
  • Endpoint responds with json listing roles/claims for that user
  • caddy-auth assigns roles/claims to token and forwards downstream
@zhirschtritt zhirschtritt added need triage question Further information is requested labels Mar 7, 2022
@zhirschtritt zhirschtritt changed the title question: iIssuing custom claims dynamically question: issuing custom claims dynamically Mar 7, 2022
@greenpau
Copy link
Owner

caddy-auth sends JWT to endpoint specified. Endpoint responds with json listing roles/claims for that user

@zhirschtritt , thank you for the issue! 👍

What would that endpoint be?

My understanding is you want to have a "hook" into an "entitlement" system that would have role (or other info) info. Is that correct?

The idea would be that one could have Google, Microsoft, Github, etc. ... however, there will be some other system that would provide the "roles" to the users authenticated with public OAuth services.

@zhirschtritt
Copy link
Author

My understanding is you want to have a "hook" into an "entitlement" system that would have role (or other info) info. Is that correct?

Right, exactly. This way there can be a dynamic list of roles/claims that can be applied per-user without caddy or this plugin having to expose an api or durable storage mechanism for that.

What would that endpoint be?

Just a https GET endpoint specified in the config that accepts the jwt retrieved for the user (and probably a secret shared-key in the header that the endpoint can validate) that returns json of the the roles and/or claims for that user. Like:

{
  "userId": "ddcc63b3-7864-42af-8ecf-9a76d317155e",
  "roles": ["admin"] 
}

@greenpau
Copy link
Owner

Will call it this new subsystem ClaimProvider ...

FYI, I am splitting backends to (1) "IdentityStore" and (2) "IdentityProvider"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@greenpau greenpau

Labels
authorization feature pending user response
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@greenpau @zhirschtritt