authorization: support the legacy scp claim as scopes#8062
authorization: support the legacy scp claim as scopes#8062zirain merged 3 commits intoenvoyproxy:mainfrom
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 canceled.
|
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
ab275b1 to
4641eda
Compare
| // The value of the scopes field should be a space delimited string that is expected in the scope parameter, | ||
| // as defined in RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749#page-23. | ||
| // The value of the scopes field should be a space delimited string that is expected in the | ||
| // scope (or scp) claim, as defined in RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749#page-23. |
There was a problem hiding this comment.
For Okta, the value of the scope claim is a JSON array. Should we support JSON array values for this claim now or in the future?
There was a problem hiding this comment.
I haven't tested this against Okta, but JSON array should have already been supported as the Envoy JWT auth filter normalizes the scopes to string array.
Each claim in this list will be interpreted as a space-delimited string and converted to a list of strings based on the delimited values. Example: a token with a claim scope: "email profile" is translated to dynamic metadata scope: ["email", "profile"] if this field is set value ["scope"].
ea63c35 to
7080187
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8062 +/- ##
==========================================
- Coverage 73.80% 73.76% -0.04%
==========================================
Files 237 237
Lines 35753 35763 +10
==========================================
- Hits 26386 26381 -5
- Misses 7512 7523 +11
- Partials 1855 1859 +4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
* authorization: support the legacy scp claim as scopes Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>
Implement: #8027