Skip to content

Commit 6b2a664

Browse files
weichchWei Chen
weichch
and
Wei Chen
authored
[AKS] add structured authn to preview (#36312)
* Add jwt authn paths, defs and parameters * Add JWT examples * Fix examples * Fix create update example * Fix another create or update example * Fix lint --------- Co-authored-by: Wei Chen <[email protected]>
1 parent 341b0cc commit 6b2a664

File tree

5 files changed

+720
-0
lines changed

5 files changed

+720
-0
lines changed

‎specification/containerservice/resource-manager/Microsoft.ContainerService/aks/preview/2025-07-02-preview/examples/JWTAuthenticators_Create_Or_Update.json

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
{
2+
"parameters": {
3+
"api-version": "2025-07-02-preview",
4+
"subscriptionId": "00000000-0000-0000-0000-000000000000",
5+
"resourceGroupName": "rg1",
6+
"resourceName": "clustername1",
7+
"jwtAuthenticatorName": "jwt1",
8+
"parameters": {
9+
"properties": {
10+
"issuer": {
11+
"url": "https://example.com",
12+
"audiences": [
13+
"https://example.com/audience1",
14+
"https://example.com/audience2"
15+
]
16+
},
17+
"claimValidationRules": [
18+
{
19+
"expression": "has(claims.sub)",
20+
"message": "Sub is required"
21+
},
22+
{
23+
"expression": "claims.sub != ''",
24+
"message": "Sub cannot be empty"
25+
}
26+
],
27+
"claimMappings": {
28+
"username": {
29+
"expression": "'aks:jwt:' + claims.sub"
30+
},
31+
"groups": {
32+
"expression": "claims.groups.split(',').map(group, 'aks:jwt:' + group)"
33+
},
34+
"extra": [
35+
{
36+
"key": "example.com/extrakey",
37+
"valueExpression": "claims.customfield"
38+
}
39+
]
40+
},
41+
"userValidationRules": [
42+
{
43+
"expression": "user.groups.all(group, group.startsWith('aks:jwt:admin:'))",
44+
"message": "Must be in admin user group"
45+
}
46+
]
47+
}
48+
}
49+
},
50+
"responses": {
51+
"200": {
52+
"body": {
53+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/clustername1/jwtAuthenticators/jwt1",
54+
"type": "Microsoft.ContainerService/managedClusters/jwtAuthenticators",
55+
"name": "jwt1",
56+
"properties": {
57+
"provisioningState": "Succeeded",
58+
"issuer": {
59+
"url": "https://example.com",
60+
"audiences": [
61+
"https://example.com/audience1",
62+
"https://example.com/audience2"
63+
]
64+
},
65+
"claimValidationRules": [
66+
{
67+
"expression": "has(claims.sub)",
68+
"message": "Sub is required"
69+
},
70+
{
71+
"expression": "claims.sub != ''",
72+
"message": "Sub cannot be empty"
73+
}
74+
],
75+
"claimMappings": {
76+
"username": {
77+
"expression": "'aks:jwt:' + claims.sub"
78+
},
79+
"groups": {
80+
"expression": "claims.groups.split(',').map(group, 'aks:jwt:' + group)"
81+
},
82+
"extra": [
83+
{
84+
"key": "example.com/extrakey",
85+
"valueExpression": "claims.customfield"
86+
}
87+
]
88+
},
89+
"userValidationRules": [
90+
{
91+
"expression": "user.groups.all(group, group.startsWith('aks:jwt:admin:'))",
92+
"message": "Must be in admin user group"
93+
}
94+
]
95+
}
96+
}
97+
},
98+
"201": {
99+
"body": {
100+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/clustername1/jwtAuthenticators/jwt1",
101+
"type": "Microsoft.ContainerService/managedClusters/jwtAuthenticators",
102+
"name": "jwt1",
103+
"properties": {
104+
"provisioningState": "Succeeded",
105+
"issuer": {
106+
"url": "https://example.com",
107+
"audiences": [
108+
"https://example.com/audience1",
109+
"https://example.com/audience2"
110+
]
111+
},
112+
"claimValidationRules": [
113+
{
114+
"expression": "has(claims.sub)",
115+
"message": "Sub is required"
116+
},
117+
{
118+
"expression": "claims.sub != ''",
119+
"message": "Sub cannot be empty"
120+
}
121+
],
122+
"claimMappings": {
123+
"username": {
124+
"expression": "'aks:jwt:' + claims.sub"
125+
},
126+
"groups": {
127+
"expression": "claims.groups.split(',').map(group, 'aks:jwt:' + group)"
128+
},
129+
"extra": [
130+
{
131+
"key": "example.com/extrakey",
132+
"valueExpression": "claims.customfield"
133+
}
134+
]
135+
},
136+
"userValidationRules": [
137+
{
138+
"expression": "user.groups.all(group, group.startsWith('aks:jwt:admin:'))",
139+
"message": "Must be in admin user group"
140+
}
141+
]
142+
}
143+
}
144+
}
145+
}
146+
}

‎specification/containerservice/resource-manager/Microsoft.ContainerService/aks/preview/2025-07-02-preview/examples/JWTAuthenticators_Delete.json

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"parameters": {
3+
"api-version": "2025-07-02-preview",
4+
"subscriptionId": "00000000-0000-0000-0000-000000000000",
5+
"resourceGroupName": "rg1",
6+
"resourceName": "clustername1",
7+
"jwtAuthenticatorName": "jwt1"
8+
},
9+
"responses": {
10+
"202": {
11+
"headers": {
12+
"Location": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerService/locations/eastus/operationStatus/default/operationId/00000000-0000-0000-0000-000000000000?api-version=2025-07-02-preview"
13+
}
14+
},
15+
"204": {}
16+
}
17+
}

‎specification/containerservice/resource-manager/Microsoft.ContainerService/aks/preview/2025-07-02-preview/examples/JWTAuthenticators_Get.json

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"parameters": {
3+
"api-version": "2025-07-02-preview",
4+
"subscriptionId": "00000000-0000-0000-0000-000000000000",
5+
"resourceGroupName": "rg1",
6+
"resourceName": "clustername1",
7+
"jwtAuthenticatorName": "jwt1"
8+
},
9+
"responses": {
10+
"200": {
11+
"body": {
12+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/clustername1/jwtAuthenticators/jwt1",
13+
"type": "Microsoft.ContainerService/managedClusters/jwtAuthenticators",
14+
"name": "jwt1",
15+
"properties": {
16+
"provisioningState": "Succeeded",
17+
"issuer": {
18+
"url": "https://example.com",
19+
"audiences": [
20+
"https://example.com/audience1",
21+
"https://example.com/audience2"
22+
]
23+
},
24+
"claimValidationRules": [
25+
{
26+
"expression": "has(claims.sub)",
27+
"message": "Sub is required"
28+
},
29+
{
30+
"expression": "claims.sub != ''",
31+
"message": "Sub cannot be empty"
32+
}
33+
],
34+
"claimMappings": {
35+
"username": {
36+
"expression": "'aks:jwt:' + claims.sub"
37+
},
38+
"groups": {
39+
"expression": "claims.groups.split(',').map(group, 'aks:jwt:' + group)"
40+
},
41+
"extra": [
42+
{
43+
"key": "example.com/extrakey",
44+
"valueExpression": "claims.customfield"
45+
}
46+
]
47+
},
48+
"userValidationRules": [
49+
{
50+
"expression": "user.groups.all(group, group.startsWith('aks:jwt:admin:'))",
51+
"message": "Must be in admin user group"
52+
}
53+
]
54+
}
55+
}
56+
}
57+
}
58+
}

‎specification/containerservice/resource-manager/Microsoft.ContainerService/aks/preview/2025-07-02-preview/examples/JWTAuthenticators_List.json

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"parameters": {
3+
"api-version": "2025-07-02-preview",
4+
"subscriptionId": "00000000-0000-0000-0000-000000000000",
5+
"resourceGroupName": "rg1",
6+
"resourceName": "clustername1"
7+
},
8+
"responses": {
9+
"200": {
10+
"body": {
11+
"value": [
12+
{
13+
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/rg1/providers/Microsoft.ContainerService/managedClusters/clustername1/jwtAuthenticators/jwt1",
14+
"type": "Microsoft.ContainerService/managedClusters/jwtAuthenticators",
15+
"name": "jwt1",
16+
"properties": {
17+
"provisioningState": "Succeeded",
18+
"issuer": {
19+
"url": "https://example.com",
20+
"audiences": [
21+
"https://example.com/audience1",
22+
"https://example.com/audience2"
23+
]
24+
},
25+
"claimValidationRules": [
26+
{
27+
"expression": "has(claims.sub)",
28+
"message": "Sub is required"
29+
},
30+
{
31+
"expression": "claims.sub != ''",
32+
"message": "Sub cannot be empty"
33+
}
34+
],
35+
"claimMappings": {
36+
"username": {
37+
"expression": "'aks:jwt:' + claims.sub"
38+
},
39+
"groups": {
40+
"expression": "claims.groups.split(',').map(group, 'aks:jwt:' + group)"
41+
},
42+
"extra": [
43+
{
44+
"key": "example.com/extrakey",
45+
"valueExpression": "claims.customfield"
46+
}
47+
]
48+
},
49+
"userValidationRules": [
50+
{
51+
"expression": "user.groups.all(group, group.startsWith('aks:jwt:admin:'))",
52+
"message": "Must be in admin user group"
53+
}
54+
]
55+
}
56+
}
57+
]
58+
}
59+
}
60+
}
61+
}

0 commit comments

Comments
 (0)