Implement OpenID token expressions evaluation #63
Conversation
There was a problem hiding this comment.
Thank you for the PR, a bit complex since this adds lots of things in the same PR - would have been nice if this could be split, but that's ok.
I've put few remarks, and the patch seems breaking.
Also, you might need to rebase, since I've merged some lib updates.
| func main() { | ||
| var configFile string | ||
| flag.StringVar(&configFile, "config", "", "The path to the configuration file") | ||
| dynamicClientInfo := flag.Bool("dynamic-client-info", false, "Dynamically read client information") |
There was a problem hiding this comment.
This seems breaking. If I read correctly, you're replacing option -dynamic-client-info by option -dynamic/-d which clearly breaks the bakward compatibility. If so please mark it as breaking
| @@ -41,15 +49,15 @@ func (ocf *StaticOIDCClientsStore) GetClient(domain string) (*OIDCClientConfig, | |||
| return nil, ErrOIDCClientConfigNotFound | |||
| } | |||
|
|
|||
| func (ocf *StaticOIDCClientsStore) AddClient(domain string, clientid string, clientsecret string, redirecturl string) { | |||
| func (ocf *StaticOIDCClientsStore) AddClient(domain, clientid, clientsecret, redirecturl string) { | |||
There was a problem hiding this comment.
Could you please keep the parameters type ?
| @@ -14,7 +11,7 @@ type OIDCClientConfig struct { | |||
| type OIDCClientsStore interface { | |||
| // Retrieve the client_id and client_secret based on the domain | |||
| GetClient(domain string) (*OIDCClientConfig, error) | |||
| AddClient(domain string, clientid string, clientsecret string, redirecturl string) | |||
| AddClient(domain, clientid, clientsecret, redirecturl string) | |||
There was a problem hiding this comment.
Could you please keep the parameters type ?
|
|
||
| # If set, the LDAP authenticator is enabled | ||
| ldap: | ||
| # SPOE message name as it is defined in HAProxy spoe-message {{ NAME }} value. | ||
| spoe_message: "try-auth-ldap" |
| } | ||
| } | ||
|
|
||
| return &StaticOIDCClientsStore{clients: clients} | ||
| } | ||
|
|
||
| func NewEmptyStaticOIDCClientStore() *StaticOIDCClientsStore { |
There was a problem hiding this comment.
This could probably be removed since never used
| return "" | ||
| } | ||
|
|
||
| const ( |
There was a problem hiding this comment.
To simplify, you could probably merge this with the constants
operationIn string = "in"
operationNotIn string = "notin"
operationExists string = "exists"
operationDoesNotExist string = "doesnotexist"
)```
so that during the assignement it becomes as simple as
expr.Operation = val[0].value
This PR implements an OpenID token expression evaluation.
The idea and the use-case is to be able to define different behavior in HAProxy based on OpenID token claims.
An example:
roleswhich is an array of admin, viewer, editor;/adminURL path only for people withadminrole;With this PR, it is possible to define in HAProxy: