DependencyTrack / DependencyTrack/dependency-track

Allow custom claim parser during OIDC login procedure for teams resolution

Open
#3,908 2 comments 0 reactions 0 assignees View on GitHub
enhancement good first issue hacktoberfest p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
9h 4m
Merged PRs (30d)
229

Description

### Current Behavior

Right now we can configure `ALPINE_OIDC_TEAMS_CLAIM` and specify the claim that carries the group/team association of a person that logs in. This currently only works if this claim is a list of strings.
Certain environments do not support this properly, for example if you connect an Azure AD to AWS Cognito and then sign in via OIDC into Dependency Track the original AD groups are mapped to a claim like "custom:groups", however Cognito only supports strings there. That means we end up with ID token claims like this

```
{
"cognito:groups":["cognitoCreatedGroupForAllUsers"],
"custom:groups: "[uuid1, uuid2, uuid3]"
}
```

I would like to be able to make use of our "custom:groups" claim to map it to DT teams at the end.

### Proposed Behavior

I can imagine two ways of solving this.

1. Create a way to allow users to inject custom claim parsers.
If this would be a regular java library one could create an interface and let people register custom parsers for arbitrary fields. I have a hard time imagining how this could be achieved in the current docker based distribution.

2. Create a special "relaxedGroupClaimParser" flag.
This could be implemented in a way that
- if its a list of strings then continue as before
- if its a string then trim it, remove [], split it by ",", trim the result list (stuff like this)

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Research direction

Start by locating the OIDC login procedure and the team-resolution handling for ALPINE_OIDC_TEAMS_CLAIM. Compare the current list-of-strings behavior with the string-valued custom:groups claim and determine, with maintainers, whether configurable parsers or a relaxed parser is required. Done means the selected behavior maps the claim to Dependency-Track teams without breaking existing claims.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, authorization
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.