Repository navigation
AuthZEN allow configurable subject lookup semantics #48288
Description
Description
#48287 makes it so the default user lookup is based upon username, but in some circumstances it may be desirable for user looks up to still be based up the Keycloak UUID or email.
We can cater for this by making use of namespaces in the subject.id field.
ID:
"subject": {
"type": "user",
"id": "id:f81d4fae-7dec-11d0-a765-00a0c91e6bf6"
}Username:
"subject": {
"type": "user",
"id": "username:alice"
}Email:
"subject": {
"type": "user",
"id": "email:alice@example.org"
}When no namespace is present, we can have the following fallback strategy:
- If the
subject.idis in UUID format, lookup by ID - Else lookup by username
We can't attempt to fallback to email lookups if @ is present as this can also be in usernames. If duplicate emails are allowed in the realm settings, then requests using the email namespace, e.g. subject.id: "email: ..." should return a 400 Bad Request response.
Metadata
Metadata
Assignees
Type
Fields
No fields configured for task.
Projects
- Status
Activity
[-]Allow user lookups based upon Keycloak UUID[/-][+]AuthZEN Allow user lookups based upon Keycloak UUID[/+][-]AuthZEN Allow user lookups based upon Keycloak UUID[/-][+]AuthZEN Allow configurable subject lookup semantics[/+][-]AuthZEN Allow configurable subject lookup semantics[/-][+]AuthZEN allow configurable subject lookup semantics[/+]AuthZEN allow configurable subject lookup semantics
AuthZEN allow configurable subject lookup semantics
31 remaining items
AuthZEN allow configurable subject lookup semantics