support mapping JWT claims (close #3485) #3575

rakeshkky · 2019-12-20T13:20:52Z

~~improve json path parser to accept keys in bracket notation with single quotes (Eg:- $.['random.com'].user)~~ Being done via allow special characters in json path's property name (close #3890) #3892
tests
docs
property tests for json path parser
implement the updated spec

Description

Some providers don't let users add custom JWT claims. In such a case, the server will provide a JWT configuration option to specify a mapping of hasura session variables to values in existing claims via JSONPaths. Now JWT config supports an extra optional field claims_map which is a JSON object which maps from session variables to jsonpaths.

Example:-

Consider the following JWT claim:

  {
    "sub": "1234567890",
    "name": "John Doe",
    "admin": true,
    "iat": 1516239022,
    "user": {
      "id": "ujdh739kd",
       "appRoles": ["user", "editor"]
    }
  }

The mapping for x-hasura-allowed-roles, x-hasura-default-role and x-hasura-user-id session variables can be specified in claims_map configuration as follows.

--jwt-secret or HASURA_GRAPHQL_JWT_SECRET

  {
    "type":"RS512",
    "key": "<The public Key>",
    "claims_map": {
      "x-hasura-allowed-roles": {"path":"$.user.appRoles"},
      "x-hasura-default-role": {"path":"$.user.appRoles[0]","default":"user"},
      "x-hasura-user-id": {"path":"$.user.id"}
    }
  }

The syntax to provide literal values in the JWT claims_map:

  {
    "type":"RS512",
    "key": "<The public Key>",
    "claims_map": {
      "x-hasura-allowed-roles": ["user","editor"],
      "x-hasura-default-role": "user",
      "x-hasura-user-id": "1"
    }
  }

Affected components

Related Issues

closes #3485

Solution and Design

Since the claims_map accepts JSON paths, the parser in Data.JSONPath.Parser module is improved to accept keys having special characters.
Property tests for above said parser.
The JWTConfig data type is improved to remove few Maybe fields.
The core logic change is present in Hasura.Server.Auth.JWT module, where resolving the hasura claims considers the claims_map configuration.

Server checklist

Catalog upgrade

Does this PR change Hasura Catalog version?

No
Yes

Metadata

Does this PR add a new Metadata feature?

No
Yes

GraphQL

No new GraphQL schema is generated
New GraphQL schema is being generated:

Breaking changes

No Breaking changes
There are breaking changes

Steps to test and verify

Limitations, known bugs & workarounds

netlify · 2019-12-20T13:22:23Z

Deploy preview for hasura-docs ready!

Built with commit 37c841d

https://deploy-preview-3575--hasura-docs.netlify.com

hasura-bot · 2019-12-20T13:36:24Z

Review app for commit 2ddbdb8 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-2ddbdb8b

…ts for the same

hasura-bot · 2019-12-23T10:20:01Z

Review app for commit c371218 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-c3712180

hasura-bot · 2019-12-23T11:18:59Z

Review app for commit fd94924 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-fd949247

hasura-bot · 2019-12-23T12:36:51Z

Review app for commit bb4fe73 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-bb4fe73b

hasura-bot · 2019-12-23T14:56:19Z

Review app for commit 36a3373 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-36a3373b

Resolve Conflicts: server/graphql-engine.cabal

hasura-bot · 2019-12-23T15:51:35Z

Review app for commit 37c841d deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-37c841d2

dsandip · 2020-01-16T10:05:30Z

@Oxymoron290 Could you please help us validate this? The docker image to be used for testing this is hasura/graphql-engine:pull3575-37c841d2. we can fast-track the release as soon as we have some validation from the community.

tracetechnical · 2020-02-06T14:23:58Z

@dsandip Can we help in any way to validate this? As we also very much would like this functionality.

dsandip · 2020-02-17T06:59:27Z

@pheonixtechnical Sorry about the late response. Yes, of course, we could use your help. You can use the docker image from #3575 (comment) and test it with your Azure AD account. Please confirm that you are able to get the Hasura ACL rules to work off of your JWT claims by posting a comment here? Thank you!

matjazrak · 2020-03-25T06:33:48Z

Hello,
I will test the solution with Azure B2C. I will get back with the result ASAP.
Thanx.

Resolve Conflicts: docs/graphql/manual/auth/authentication/jwt.rst server/graphql-engine.cabal server/src-lib/Hasura/Server/Auth.hs server/src-lib/Hasura/Server/Auth/JWT.hs server/src-test/Main.hs

netlify · 2020-04-09T13:10:34Z

Deploy preview for hasura-docs ready!

Built with commit b2eb72e

https://deploy-preview-3575--hasura-docs.netlify.app

tirumaraiselvan · 2020-04-09T14:24:48Z

@rakeshkky Updated spec: #3485 (comment)

Resolve Conflicts: .circleci/test-server.sh server/graphql-engine.cabal server/src-lib/Data/Parser/JSONPath.hs server/src-lib/Hasura/RQL/Types/Error.hs server/src-lib/Hasura/Server/Auth/JWT.hs server/src-lib/Hasura/Server/Config.hs server/src-lib/Hasura/Server/Utils.hs server/src-test/Main.hs server/tests-py/queries/v1/select/boolexp/postgis/query_illegal_cast_is_not_allowed.yaml server/tests-py/queries/v1/update/permissions/user_cannot_update_id_col_article.yaml

hasura-bot · 2020-08-27T07:27:08Z

Review app for commit 94282ed deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-94282ed5

hasura-bot · 2020-08-27T09:13:54Z

Review app for commit 703e2b9 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-703e2b97

tirumaraiselvan · 2020-08-27T11:04:33Z

CHANGELOG.md

 - server: treat the absence of `backend_only` configuration and `backend_only: false` equally (closing #5059) (#4111)
+- server: support customizing JWT claims (close #3485)
+
+Some providers don't let users add custom JWT claims. In such a case, the server will provide a JWT configuration option to specify a mapping of hasura session variables to values in existing claims via JSONPath/literal values. The JWT config now supports an extra optional field `claims_map` which is an JSON object which maps from session variables to JSON paths.


Suggested change

Some providers don't let users add custom JWT claims. In such a case, the server will provide a JWT configuration option to specify a mapping of hasura session variables to values in existing claims via JSONPath/literal values. The JWT config now supports an extra optional field `claims_map` which is an JSON object which maps from session variables to JSON paths.

Some auth providers do not let users add custom claims in JWT. In such cases, the server can take a JWT configuration option called `claims_map` to specify a mapping of Hasura session variables to values in existing claims via JSONPath or literal values.

tirumaraiselvan · 2020-08-27T11:05:14Z

CHANGELOG.md

+  }
+```
+
+The corresponding JWT config should be:


Suggested change

The corresponding JWT config should be:

The corresponding JWT config can be:

hasura-bot · 2020-08-27T14:37:53Z

Review app for commit 3e987ec deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-3e987ecb

tirumaraiselvan · 2020-08-27T14:40:23Z

CHANGELOG.md


 ## Next release

+### Server - Support for custom JWT Claims


Support for mapping session variables to default JWT claims

hasura-bot · 2020-08-27T15:22:19Z

Review app for commit 973750f deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-973750f0

tirumaraiselvan

approving changelog (barring small comment) and docs content (needs approval from @marionschleifer )

hasura-bot · 2020-08-27T16:19:04Z

Review app for commit baac239 deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-baac2395

hasura-bot · 2020-08-28T07:49:08Z

Review app for commit b2eb72e deployed to Heroku: https://hge-ci-pull-3575.herokuapp.com
Docker image for server: hasura/graphql-engine:pull3575-b2eb72ec

jberryman

Thanks for addressing the comments!

* improve jsonpath parser to accept special characters and property tests for the same * make the JWTClaimsMapValueG parametrizable * add documentation in the JWT file * modify processAuthZHeader Co-authored-by: Karthikeyan Chinnakonda <karthikeyan@hasura.io> Co-authored-by: Marion Schleifer <marion@hasura.io>

fixes #6449 A while back we added [support for customizing JWT claims](#3575) and this enabled to map a session variable to any value within the unregistered claims, but as reported in #6449 , users aren't able to map the `x-hasura-user-id` session variable to the `sub` standard JWT claim. This PR fixes the above issue by allowing mapping session variables to standard JWT claims as well. GitOrigin-RevId: d3e63d7

wip: support for jwt azure active directory, close hasura#3485

2ddbdb8

rakeshkky self-assigned this Dec 20, 2019

improve jsonpath parser to accept special characters and property tes…

c371218

…ts for the same

rakeshkky force-pushed the issue-3485-jwt-ad branch from 33ac1e0 to c371218 Compare December 23, 2019 09:56

fix tests

fd94924

rakeshkky added 2 commits December 23, 2019 17:49

add jwt tests with claims_map config

bb4fe73

no-op refactor in test_jwt_claims_map.py

b1912b6

fix circle ci test

36a3373

rakeshkky added 2 commits December 23, 2019 20:52

document claims_map in JWT configuration

e85994a

Merge branch 'master' into issue-3485-jwt-ad

37c841d

Resolve Conflicts: server/graphql-engine.cabal

rakeshkky added the c/server Related to server label Dec 24, 2019

ecthiender mentioned this pull request Jan 16, 2020

[RFC] support JWT claims mapping (e.g. to work with Azure Active Directory) #3485

Closed

Merge branch 'master' into issue-3485-jwt-ad

8eaa69a

Resolve Conflicts: docs/graphql/manual/auth/authentication/jwt.rst server/graphql-engine.cabal server/src-lib/Hasura/Server/Auth.hs server/src-lib/Hasura/Server/Auth/JWT.hs server/src-test/Main.hs

rakeshkky changed the title ~~support for jwt azure active directory (close #3485)~~ support customizing JWT claims (close #3485) Apr 20, 2020

tirumaraiselvan added this to the v1.3 milestone Apr 21, 2020

coco98 removed this from the v1.3 milestone Apr 24, 2020

add documentation in the JWT file

94282ed

modify processAuthZHeader

703e2b9

tirumaraiselvan reviewed Aug 27, 2020

View reviewed changes

codingkarthik added 2 commits August 27, 2020 18:59

add a spec for the parseClaimsMap function

2f8da85

document the parseClaimsMapTests spec appropriately

3e987ec

codingkarthik requested a review from jberryman August 27, 2020 13:47

update CHANGELOG

973750f

codingkarthik requested a review from tirumaraiselvan August 27, 2020 14:34

tirumaraiselvan reviewed Aug 27, 2020

View reviewed changes

tirumaraiselvan approved these changes Aug 27, 2020

View reviewed changes

update ChangeLog

baac239

Merge branch 'master' into issue-3485-jwt-ad

b2eb72e

marionschleifer approved these changes Aug 28, 2020

View reviewed changes

jberryman approved these changes Aug 31, 2020

View reviewed changes

codingkarthik merged commit 4ce6002 into hasura:master Aug 31, 2020

tirumaraiselvan added this to the v1.3.3 milestone Nov 3, 2020

coco98 mentioned this pull request Nov 4, 2020

Its impossible to use Hasura in JWT auth mode with Oracle IDCS auth provider tokens #6136

Closed

tirumaraiselvan mentioned this pull request Nov 9, 2020

Claims key: 'https://hasura.io/jwt/claims' not found when setting in firebase #4121

Closed

tirumaraiselvan changed the title ~~support customizing JWT claims (close #3485)~~ support mapping JWT claims (close #3485) Nov 10, 2020

	Some providers don't let users add custom JWT claims. In such a case, the server will provide a JWT configuration option to specify a mapping of hasura session variables to values in existing claims via JSONPath/literal values. The JWT config now supports an extra optional field `claims_map` which is an JSON object which maps from session variables to JSON paths.
	Some auth providers do not let users add custom claims in JWT. In such cases, the server can take a JWT configuration option called `claims_map` to specify a mapping of Hasura session variables to values in existing claims via JSONPath or literal values.

	The corresponding JWT config should be:
	The corresponding JWT config can be:

support mapping JWT claims (close #3485) #3575

support mapping JWT claims (close #3485) #3575

Uh oh!

Conversation

rakeshkky commented Dec 20, 2019 • edited by codingkarthik Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Affected components

Related Issues

Solution and Design

Server checklist

Catalog upgrade

Metadata

GraphQL

Breaking changes

Steps to test and verify

Limitations, known bugs & workarounds

Uh oh!

netlify bot commented Dec 20, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hasura-bot commented Dec 20, 2019

Uh oh!

hasura-bot commented Dec 23, 2019

Uh oh!

hasura-bot commented Dec 23, 2019

Uh oh!

hasura-bot commented Dec 23, 2019

Uh oh!

hasura-bot commented Dec 23, 2019

Uh oh!

hasura-bot commented Dec 23, 2019

Uh oh!

dsandip commented Jan 16, 2020

Uh oh!

tracetechnical commented Feb 6, 2020

Uh oh!

dsandip commented Feb 17, 2020

Uh oh!

matjazrak commented Mar 25, 2020

Uh oh!

netlify bot commented Apr 9, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tirumaraiselvan commented Apr 9, 2020

Uh oh!

hasura-bot commented Aug 27, 2020

Uh oh!

hasura-bot commented Aug 27, 2020

Uh oh!

tirumaraiselvan Aug 27, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tirumaraiselvan Aug 27, 2020

Choose a reason for hiding this comment

Uh oh!

hasura-bot commented Aug 27, 2020

Uh oh!

tirumaraiselvan Aug 27, 2020

Choose a reason for hiding this comment

Uh oh!

hasura-bot commented Aug 27, 2020

Uh oh!

tirumaraiselvan left a comment

Choose a reason for hiding this comment

Uh oh!

hasura-bot commented Aug 27, 2020

Uh oh!

hasura-bot commented Aug 28, 2020

Uh oh!

jberryman left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

rakeshkky commented Dec 20, 2019 •

edited by codingkarthik

Loading

netlify bot commented Dec 20, 2019 •

edited

Loading

netlify bot commented Apr 9, 2020 •

edited

Loading

tirumaraiselvan Aug 27, 2020 •

edited

Loading