docs(jans-cedarling): update readme for scope based access (#10811)

* docs(jans-cedarling): update readme for scope based access Signed-off-by: SafinWasi <[email protected]> * docs(jans-cedarling): update new doc Signed-off-by: SafinWasi <[email protected]> --------- Signed-off-by: SafinWasi <[email protected]>
JanssenProject · Feb 7, 2025 · 0966616 · 0966616
1 parent 8ffc483
commit 0966616
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 12 deletions.
diff --git a/docs/cedarling/cedarling-krakend.md b/docs/cedarling/cedarling-krakend.md
@@ -89,20 +89,21 @@ Check [KrakenD documentation](https://www.krakend.io/docs/extending/injecting-pl
 
 To test the plugin, you will need:
 
-- A cedarling policy store with a policy for our gateway. To create this, please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#setup-policy-store) steps.
-- An instance of the cedarling sidecar, using the policy store mentioned above. Please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#setup-sidecar) steps. 
+- A cedarling policy store with a policy for our gateway. To create this, please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#1-author-policies) steps.
+- An instance of the cedarling sidecar, using the policy store mentioned above. Please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#2-deploy-cedarling-sidecar) steps. 
 - For our demo, we will use this sample policy as outlined in the instructions:
     ```
     @id("allow_one")
     permit(
-        principal is gatewayDemo::Workload,
-        action == gatewayDemo::Action::"GET",
-        resource is gatewayDemo::HTTP_Request
+      principal is gatewayDemo::Workload,
+      action == gatewayDemo::Action::"GET",
+      resource is gatewayDemo::HTTP_Request
     )
     when {
-        (principal["client_id"]) == "d7f71bea-c38d-4caf-a1ba-e43c74a11a62"
+    ((principal has "access_token") && ((principal["access_token"]) has "scope")) && (((principal["access_token"])["scope"]).contains("profile"))
     };
     ```
+- This policy will allow access so long as the access token contains the `profile` scope.
 - A [KrakenD server installation](https://www.krakend.io/docs/overview/installing/). For development purposes, the binary install is recommended. For production setups, the Docker method is recommended.
 - The plugin `.so` file for your architecture. For Mac OS hosts, ARM64 is required.
 - A configuration file. Sample configuration is provided in [krakend.json](https://github.com/JanssenProject/jans/blob/main/jans-cedarling/cedarling-krakend/krakend.json).

diff --git a/jans-cedarling/cedarling-krakend/README.md b/jans-cedarling/cedarling-krakend/README.md
@@ -89,20 +89,21 @@ Check [KrakenD documentation](https://www.krakend.io/docs/extending/injecting-pl
 
 To test the plugin, you will need:
 
-- A cedarling policy store with a policy for our gateway. To create this, please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#setup-policy-store) steps.
-- An instance of the cedarling sidecar, using the policy store mentioned above. Please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#setup-sidecar) steps. 
+- A cedarling policy store with a policy for our gateway. To create this, please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#1-author-policies) steps.
+- An instance of the cedarling sidecar, using the policy store mentioned above. Please follow [these](https://github.com/JanssenProject/jans/wiki/Cedarling-Hello-World-%5BWIP%5D#2-deploy-cedarling-sidecar) steps. 
 - For our demo, we will use this sample policy as outlined in the instructions:
     ```
     @id("allow_one")
     permit(
-        principal is gatewayDemo::Workload,
-        action == gatewayDemo::Action::"GET",
-        resource is gatewayDemo::HTTP_Request
+      principal is gatewayDemo::Workload,
+      action == gatewayDemo::Action::"GET",
+      resource is gatewayDemo::HTTP_Request
     )
     when {
-        (principal["client_id"]) == "d7f71bea-c38d-4caf-a1ba-e43c74a11a62"
+    ((principal has "access_token") && ((principal["access_token"]) has "scope")) && (((principal["access_token"])["scope"]).contains("profile"))
     };
     ```
+- This policy will allow access so long as the access token contains the `profile` scope.
 - A [KrakenD server installation](https://www.krakend.io/docs/overview/installing/). For development purposes, the binary install is recommended. For production setups, the Docker method is recommended.
 - The plugin `.so` file for your architecture. For Mac OS hosts, ARM64 is required.
 - A configuration file. Sample configuration is provided in [krakend.json](https://github.com/JanssenProject/jans/blob/main/jans-cedarling/cedarling-krakend/krakend.json).