Added "--auth.user" option to auth commands

Author: ewoutp

auth.go

@@ -50,6 +50,7 @@ var (
 	}
 	authOptions struct {
 		jwtSecretFile string
+		user          string
 	}
 )
 
@@ -60,6 +61,7 @@ func init() {
 
 	pf := cmdAuth.PersistentFlags()
 	pf.StringVar(&authOptions.jwtSecretFile, "auth.jwt-secret", "", "name of a plain text file containing a JWT secret used for server authentication")
+	pf.StringVar(&authOptions.user, "auth.user", "", "name of a user to authenticate as. If empty, 'super-user' authentication is used")
 }
 
 // mustAuthCreateJWTToken creates a the JWT token based on authentication options.
@@ -75,7 +77,7 @@ func mustAuthCreateJWTToken() string {
 		log.Fatal().Err(err).Msgf("Failed to read JWT secret file '%s'", authOptions.jwtSecretFile)
 	}
 	jwtSecret := strings.TrimSpace(string(content))
-	token, err := service.CreateJwtToken(jwtSecret)
+	token, err := service.CreateJwtToken(jwtSecret, authOptions.user)
 	if err != nil {
 		log.Fatal().Err(err).Msg("Failed to create JWT token")
 	}

service/authentication.go

@@ -35,16 +35,20 @@ const (
 
 // CreateJwtToken calculates a JWT authorization token based on the given secret.
 // If the secret is empty, an empty token is returned.
-func CreateJwtToken(jwtSecret string) (string, error) {
+func CreateJwtToken(jwtSecret, user string) (string, error) {
 	if jwtSecret == "" {
 		return "", nil
 	}
 	// Create a new token object, specifying signing method and the claims
 	// you would like it to contain.
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+	claims := jwt.MapClaims{
 		"iss":       "arangodb",
 		"server_id": "foo",
-	})
+	}
+	if user != "" {
+		claims["preferred_username"] = user
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 
 	// Sign and get the complete encoded token as a string using the secret
 	signedToken, err := token.SignedString([]byte(jwtSecret))
@@ -62,7 +66,7 @@ func addJwtHeader(req *http.Request, jwtSecret string) error {
 	if jwtSecret == "" {
 		return nil
 	}
-	signedToken, err := CreateJwtToken(jwtSecret)
+	signedToken, err := CreateJwtToken(jwtSecret, "")
 	if err != nil {
 		return maskAny(err)
 	}