JWT roles from nested key

Search Guard
1

Hello,

I use elasticsearch 6.3.2 with searchguard 6.24 and need to extract roles from a JWT that are contained in a nested key with following syntax:

“realm_access”: {
“roles”: [
“foo”,
“cat”
]
}

``

I tried it with following configurations, but both result in failures:

jwt_auth_domain:
enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: xzy
subject_key: “username”
roles_key: “realm_access”
authentication_backend:
type: noop

jwt_auth_domain:
enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: xzy
subject_key: “username”
roles_key: “realm_access.roles”
authentication_backend:
type: noop

``

Is there a possibility to specifiy the nested key as roles field?

Thank you in advance!

2

Hi,

no, unfortunately at the moment nested keys are not supported. We have it in the backlog, however, there is no ETA yet.

···

On Monday, March 11, 2019 at 6:18:04 PM UTC+1, kleis wrote:

Hello,

I use elasticsearch 6.3.2 with searchguard 6.24 and need to extract roles from a JWT that are contained in a nested key with following syntax:

“realm_access”: {
“roles”: [
“foo”,
“cat”
]
}

``

I tried it with following configurations, but both result in failures:

jwt_auth_domain:
enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: xzy
subject_key: “username”
roles_key: “realm_access”
authentication_backend:
type: noop

jwt_auth_domain:
enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: xzy
subject_key: “username”
roles_key: “realm_access.roles”
authentication_backend:
type: noop

``

Is there a possibility to specifiy the nested key as roles field?

Thank you in advance!

3

Hopefully this moves up the queue quickly. Not having this ability makes it pretty useless to use JWT tokens since not being able to access the backend roles severely limits the usefulness of the JWT authc/authz feature.

···

On Tuesday, March 12, 2019 at 1:22:29 PM UTC-4, Jochen Kressin wrote:

Hi,

no, unfortunately at the moment nested keys are not supported. We have it in the backlog, however, there is no ETA yet.

On Monday, March 11, 2019 at 6:18:04 PM UTC+1, kleis wrote:

Hello,

I use elasticsearch 6.3.2 with searchguard 6.24 and need to extract roles from a JWT that are contained in a nested key with following syntax:

“realm_access”: {
“roles”: [
“foo”,
“cat”
]
}

``

I tried it with following configurations, but both result in failures:

jwt_auth_domain:
enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: xzy
subject_key: “username”
roles_key: “realm_access”
authentication_backend:
type: noop

jwt_auth_domain:
enabled: true
order: 0
http_authenticator:
type: jwt
challenge: false
config:
signing_key: xzy
subject_key: “username”
roles_key: “realm_access.roles”
authentication_backend:
type: noop

``

Is there a possibility to specifiy the nested key as roles field?

Thank you in advance!

4

I was about to post on just this topic.

Is this still on the roadmap, or has it been implemented?

We’re interested in using Keycloak client roles to support authz in SearchGuard roles.