Hello,

I am currently integrating Keycloak with Eclipse Ditto. Since granting user permissions is done elsewhere from ditto, my idea is to map specific resources and scopes as subjects in Ditto and use a user's RPT token as the input of this mapping. The RPT token, granted by keycloak, is a JWT token that contains some user's permissions. The structure is as follows:

{
  "authorization": {
      "permissions": [
        {
          "scopes": [ "device.read" ],
          "resource_set_id": "d2fe9843-6462-4bfc-baba-b5787bb6e0e7",
          "resource_set_name": "Device 1"
        },
        {
          "scopes": [ "device.read", "device.write" ],
          "resource_set_id": "d2fe9843-6462-4bfc-baba-b5787bb6e0e7",
          "resource_set_name": "Device 12
        }
      ]
  },
  "jti": "d6109a09-78fd-4998-bf89-95730dfd0892-1464906679405",
  "exp": 1464906971,
  "nbf": 0,
  "iat": 1464906671,
  "sub": "f1888f4d-5172-4359-be0c-af338505d86c",
  "typ": "kc_ett",
  "azp": "hello-world-authz-service"
}

my idea is to then, from this RPT, generate subjects:

• d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.read
• d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.read
• d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.write.
  With these subjects, a policy for a thing would include these subjects in the appropriate place (e.g. subject d2fe9843-6462-4bfc-baba-b5787bb6e0e7#device.read would be granted permission to read thing d2fe9843-6462-4bfc-baba-b5787bb6e0e7).

I have tried using jwt placeholders to convert the JWT token to the format I require, but I am not sure if it is possible. It seems that the supported json operations are very limited. For example, using the token structure above:

• JSON pointer indexing does not work (example: authorization/permissions/0)
• Can't do operations in nested objects. To reach something like resource_set_id#scope, I would have to do something like {{ jwt:authorization/permissions | join(resource_set_id, scopes, '#') }} (join function is merely ilustrative). The issue here is everything to the output of jwt:claim is acted on as a string and not as objects themselves.

Am I correct in assuming that the mapping I want is not currently possible using placeholders?

Thank you.