Skip to content

Commit b966ab7

Browse files
MarcialRosalesmichaelklishin
MarcialRosales
authored and
michaelklishin
committed
Configure scope_aliases also per resource_server
1 parent 3e81cfa commit b966ab7

File tree

3 files changed

+141
-2
lines changed

3 files changed

+141
-2
lines changed

‎deps/rabbitmq_auth_backend_oauth2/priv/schema/rabbitmq_auth_backend_oauth2.schema

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,21 @@
375375
[{datatype, string}]
376376
}.
377377

378+
{mapping,
379+
"auth_oauth2.resource_servers.$name.scope_aliases.$alias",
380+
"rabbitmq_auth_backend_oauth2.resource_servers",
381+
[{datatype, string}]}.
382+
383+
{mapping,
384+
"auth_oauth2.resource_servers.$name.scope_aliases.$index.alias",
385+
"rabbitmq_auth_backend_oauth2.resource_servers",
386+
[{datatype, string}]}.
387+
388+
{mapping,
389+
"auth_oauth2.resource_servers.$name.scope_aliases.$index.scope",
390+
"rabbitmq_auth_backend_oauth2.resource_servers",
391+
[{datatype, string}]}.
392+
378393
{mapping,
379394
"auth_oauth2.resource_servers.$name.oauth_provider_id",
380395
"rabbitmq_auth_backend_oauth2.resource_servers",

‎deps/rabbitmq_auth_backend_oauth2/src/rabbit_oauth2_schema.erl

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,60 @@ extract_scope_alias_mapping(Proplist) ->
7878
_ = V -> V
7979
end.
8080

81+
extract_resource_server_scope_aliases_as_list_of_props(Settings) ->
82+
KeyFun = fun extract_key_as_binary/1,
83+
ValueFun = fun extract_value/1,
84+
85+
List0 = [
86+
{
87+
Name,
88+
{Index, {list_to_atom(Attr), V}}
89+
} ||
90+
{[
91+
?AUTH_OAUTH2, ?RESOURCE_SERVERS, Name, ?SCOPE_ALIASES,
92+
Index, Attr
93+
], V
94+
} <- Settings ],
95+
Map0 = maps:groups_from_list(KeyFun, ValueFun, List0),
96+
97+
Map4 = maps:map(fun (_, L) ->
98+
Map2 = maps:map(fun (_, L2) -> extract_scope_alias_mapping(L2) end,
99+
maps:groups_from_list(KeyFun, ValueFun, L)),
100+
Map3 = maps:filter(fun (_,V) -> V =/= {} end, Map2),
101+
[{scope_aliases, maps:from_list([ V || {_, V} <- maps:to_list(Map3)])}]
102+
end, Map0),
103+
104+
Map4.
105+
106+
extract_resource_server_scope_aliases_as_map(Settings) ->
107+
KeyFun = fun extract_key_as_binary/1,
108+
ValueFun = fun extract_value/1,
109+
110+
List0 = [
111+
{
112+
Name,
113+
{
114+
list_to_binary(Alias),
115+
convert_space_separated_string_to_list_of_binaries(Scope)
116+
}
117+
} ||
118+
{[
119+
?AUTH_OAUTH2, ?RESOURCE_SERVERS, Name, ?SCOPE_ALIASES,
120+
Alias
121+
], Scope
122+
} <- Settings ],
123+
Map0 = maps:groups_from_list(KeyFun, ValueFun, List0),
124+
maps:map(fun (_, L) -> [{scope_aliases, maps:from_list(L)}] end, Map0).
125+
81126
-spec translate_resource_servers([{list(), binary()}]) -> map().
82127
translate_resource_servers(Conf) ->
83128
Settings = cuttlefish_variable:filter_by_prefix(
84129
?AUTH_OAUTH2_RESOURCE_SERVERS, Conf),
85130
Map = merge_list_of_maps([
86131
extract_resource_server_properties(Settings),
87-
extract_resource_server_preferred_username_claims(Settings)
132+
extract_resource_server_preferred_username_claims(Settings),
133+
extract_resource_server_scope_aliases_as_list_of_props(Settings),
134+
extract_resource_server_scope_aliases_as_map(Settings)
88135
]),
89136
Map0 = maps:map(fun(K,V) ->
90137
case proplists:get_value(id, V) of
@@ -97,7 +144,8 @@ translate_resource_servers(Conf) ->
97144

98145
-spec translate_oauth_providers([{list(), binary()}]) -> map().
99146
translate_oauth_providers(Conf) ->
100-
Settings = cuttlefish_variable:filter_by_prefix(?AUTH_OAUTH2_OAUTH_PROVIDERS, Conf),
147+
Settings = cuttlefish_variable:filter_by_prefix(
148+
?AUTH_OAUTH2_OAUTH_PROVIDERS, Conf),
101149

102150
merge_list_of_maps([
103151
extract_oauth_providers_properties(Settings),

‎deps/rabbitmq_auth_backend_oauth2/test/config_schema_SUITE_data/rabbitmq_auth_backend_oauth2.snippets

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,5 +236,81 @@
236236
}}
237237
]}
238238
], []
239+
},
240+
{scope_aliases_3,
241+
"auth_oauth2.resource_server_id = new_resource_server_id
242+
auth_oauth2.resource_servers.a.scope_aliases.admin = rabbitmq.tag:administrator
243+
auth_oauth2.resource_servers.a.scope_aliases.developer = rabbitmq.tag:management rabbitmq.read:*/*
244+
auth_oauth2.resource_servers.b.scope_aliases.admin_b = rabbitmq.tag:administrator
245+
auth_oauth2.resource_servers.b.scope_aliases.developer_b = rabbitmq.tag:management rabbitmq.read:*/*",
246+
[
247+
{rabbitmq_auth_backend_oauth2, [
248+
{resource_server_id,<<"new_resource_server_id">>},
249+
{resource_servers, #{
250+
<<"a">> => [
251+
{scope_aliases, #{
252+
<<"admin">> => [
253+
<<"rabbitmq.tag:administrator">>
254+
],
255+
<<"developer">> => [
256+
<<"rabbitmq.tag:management">>,
257+
<<"rabbitmq.read:*/*">>
258+
]
259+
}},
260+
{id, <<"a">>}
261+
],
262+
<<"b">> => [
263+
{scope_aliases, #{
264+
<<"admin_b">> => [
265+
<<"rabbitmq.tag:administrator">>
266+
],
267+
<<"developer_b">> => [
268+
<<"rabbitmq.tag:management">>,
269+
<<"rabbitmq.read:*/*">>
270+
]
271+
}},
272+
{id, <<"b">>}
273+
]
274+
}
275+
}
276+
]}
277+
], []
278+
},
279+
{scope_aliases_4,
280+
"auth_oauth2.resource_server_id = new_resource_server_id
281+
auth_oauth2.resource_servers.b.scope_aliases.1.alias = admin_b
282+
auth_oauth2.resource_servers.b.scope_aliases.1.scope = rabbitmq.tag:administrator
283+
auth_oauth2.resource_servers.a.scope_aliases.1.alias = admin
284+
auth_oauth2.resource_servers.a.scope_aliases.1.scope = rabbitmq.tag:administrator
285+
auth_oauth2.resource_servers.a.scope_aliases.2.alias = developer
286+
auth_oauth2.resource_servers.a.scope_aliases.2.scope = rabbitmq.tag:management rabbitmq.read:*/*",
287+
[
288+
{rabbitmq_auth_backend_oauth2, [
289+
{resource_server_id,<<"new_resource_server_id">>},
290+
{resource_servers, #{
291+
<<"a">> => [
292+
{scope_aliases, #{
293+
<<"admin">> => [
294+
<<"rabbitmq.tag:administrator">>
295+
],
296+
<<"developer">> => [
297+
<<"rabbitmq.tag:management">>,
298+
<<"rabbitmq.read:*/*">>
299+
]
300+
}},
301+
{id, <<"a">>}
302+
],
303+
<<"b">> => [
304+
{scope_aliases, #{
305+
<<"admin_b">> => [
306+
<<"rabbitmq.tag:administrator">>
307+
]
308+
}},
309+
{id, <<"b">>}
310+
]
311+
}
312+
}
313+
]}
314+
], []
239315
}
240316
].

0 commit comments

Comments
 (0)