envoyproxy / envoyproxy/gateway

JWT Claims array (multiple values) to Headers are being base64 encoded

Aperta
#3,084 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
stale triage
Lingua principale
Go
Stelle
3k
Fork
864
Merge medio
2g 2h
PR unite (30g)
140

Descrizione

*Description*:

I'm trying to use a feature of envoy gateway, JWT Claims to Headers. But when I have a Claim that is an Array, like this

```json
"realm_access": {
"roles": [
"poc-roles",
"offline_access",
"default-roles-cilium-poc",
"uma_authorization"
]
}
```

It is transforming it to a base64 Header, like this:
```
"X-Token-Roles": "WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl0=",
```

My config is this:

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: jwt-bin
namespace: my-system
spec:
targetRef:
group: gateway.networking.k8s.io
kind: HTTPRoute
name: bin-route
namespace: my-system
jwt:
providers:
- name: keycloak
remoteJWKS:
uri: xxxxx
claimToHeaders:
- claim: resource_access.account.roles
header: x-token-roles
- claim: sub
header: x-token-sub
```
Is this what is expected? How can I add other checks/redirects if its in base64?

*Repro steps*:

Use a JWT that contains an claim as a array an put this claim in the claimToHeaders like I did.

Example JWT:
```
eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IjRkNDhlNjU0MGNjMWU4NDhjOWVjOTVhYWY0ZDdlMGU1In0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNzEyMTU0NzI0LCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsicG9jLXJvbGVzIiwib2ZmbGluZV9hY2Nlc3MiLCJkZWZhdWx0LXJvbGVzLWNpbGl1bS1wb2MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfX0.lkZOPZiyiAqlX224cW1I4oQ7cAql77qOg656PonJNJ2uXOM5QSLuQxELwG74df3sgq7SfH8zanV2LIbTkqdK9w
```

*Environment*:
Using v1.0.0

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.