lazedo commented on issue #4663:
URL: https://github.com/apache/couchdb/issues/4663#issuecomment-1630265536
we added a `admin_roles` config. feel free to use/adapt the below (needs
rebase)
```
diff --git a/src/couch/src/couch_httpd_auth.erl
b/src/couch/src/couch_httpd_auth.erl
index 24a0c15ed..07d4df4f3 100644
--- a/src/couch/src/couch_httpd_auth.erl
+++ b/src/couch/src/couch_httpd_auth.erl
@@ -230,21 +230,10 @@ jwt_authentication_handler(Req) ->
case lists:keyfind(<<"sub">>, 1, Claims) of
false ->
throw({unauthorized, <<"Token missing sub
claim.">>});
- {_, User} ->
- Req#httpd{
- user_ctx = #user_ctx{
- name = User,
- roles = couch_util:get_value(
- ?l2b(
- config:get(
- "jwt_auth",
"roles_claim_name", "_couchdb.roles"
- )
- ),
- Claims,
- []
- )
- }
- }
+ {_, User} -> Req#httpd{user_ctx=#user_ctx{
+ name = User,
+ roles = jwt_roles(Claims)
+ }}
end;
{error, Reason} ->
throw(Reason)
@@ -253,6 +242,31 @@ jwt_authentication_handler(Req) ->
Req
end.
+jwt_roles(Claims) ->
+ RolesClaimName = ?l2b(config:get("jwt_auth", "roles_claim_name",
"_couchdb.roles")),
+ JWTRoles = couch_util:get_value(RolesClaimName, Claims, []),
+ case jwt_admin_roles() of
+ [] -> lists:usort(JWTRoles);
+ Roles -> jwt_verify_admin_roles(JWTRoles, Roles)
+ end.
+
+jwt_verify_admin_roles(JWTRoles, Roles) ->
+ VerifyFun = fun(JWTRole) -> lists:member(JWTRole, Roles) end,
+ case lists:any(VerifyFun, JWTRoles) of
+ true -> lists:usort([<<"_admin">> | JWTRoles]);
+ false -> lists:usort(JWTRoles)
+ end.
+
+jwt_admin_roles() ->
+ AdminRoles = string:split(config:get("jwt_auth", "admin_roles", ""),
",", all),
+ lists:filtermap(fun jwt_filter_map_admin_role/1, AdminRoles).
+
+jwt_filter_map_admin_role(Role) ->
+ case string:is_empty(Role) of
+ true -> false;
+ false -> {true, ?l2b(Role)}
+ end.
+
get_configured_claims() ->
Claims = config:get("jwt_auth", "required_claims", ""),
Re = "((?<key1>[a-z]+)|{(?<key2>[a-z]+)\s*,\s*\"(?<val>[^\"]+)\"})",
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
