Open pedro-nicolau-carvalho opened 1 month ago
Hi @pedro-nicolau-carvalho
The JWT placeholder is quite mighty: https://eclipse.dev/ditto/basic-placeholders.html#scope-openid-connect-configuration
It e.g. has a special handling for JSON arrays (and even JSON objects in arrays) - iterating over all entries and "multiplying" the result.
However, it seems we did not consider yet the "array in array" use case. It also seems that only arrays in "root level" are currently supported .. I would say this is a bug, that should work also in nested structures. I will create a ticket for that and can provide a fix.
What you however want to achieve is not yet supported, I fear .. selecting and combining fields only "on the same level". But that is a very valid and useful use case. 👍 We could track that as new issue, I am open for suggestions regarding syntax (probably a function as you suggested would be needed).
It e.g. has a special handling for JSON arrays (and even JSON objects in arrays) - iterating over all entries and "multiplying" the result.
Is it currently possible to extract a property from a nested JSON object in an array without parsing the JSON object as a string? For example, using the structure from the RPT, is it possible to extract the resource_set_id
as the authorization subjects? I have tried using {{ jwt:authorization/permissions/resource_set_id }}
and {{ jwt:authorization/permissions/0/resource_set_id }}
but without luck
As mentioned: It should be possible .. however it currently only seems to work if the array is directly at the "first level" of the JSON, see created bug issue #1985
For example, using the structure from the RPT, is it possible to extract the resource_set_idas the authorization subjects? I have tried using
{{ jwt:authorization/permissions/resource_set_id }}
and{{ jwt:authorization/permissions/0/resource_set_id }}
but without luck
Yes, that unfortunately is affected by the bug :/
{{ jwt:authorization/permissions/resource_set_id }}
should work that way ..
Using the array-index is not supported ..
Hello,
I am currently integrating Keycloak with Eclipse Ditto. Since granting user permissions is done elsewhere from ditto, my idea is to map specific resources and scopes as subjects in Ditto and use a user's RPT token as the input of this mapping. The RPT token, granted by keycloak, is a JWT token that contains some user's permissions. The structure is as follows:
my idea is to then, from this RPT, generate subjects:
d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.read
d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.read
d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.write
. With these subjects, a policy for a thing would include these subjects in the appropriate place (e.g. subjectd2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.read
would be granted permission to read thing d2fe9843-6462-4bfc-baba-b5787bb6e0e7).I have tried using jwt placeholders to convert the JWT token to the format I require, but I am not sure if it is possible. It seems that the supported json operations are very limited. For example, using the token structure above:
authorization/permissions/0
)resource_set_id#scope
, I would have to do something like{{ jwt:authorization/permissions | join(resource_set_id, scopes, '#') }}
(join
function is merely ilustrative). The issue here is everything to the output ofjwt:claim
is acted on as a string and not as objects themselves.Am I correct in assuming that the mapping I want is not currently possible using placeholders?
Thank you.