Create a separate staff schema based on email domain and add support for impersonation header

Signed-off-by: Federico Busetti <[email protected]>

Author: febus982

.idea/dataSources.xml

@@ -1,5 +1,4 @@
 {
-  "$id": "https://schemas.ory.sh/presets/kratos/quickstart/email-password/identity.schema.json",
   "$schema": "http://json-schema.org/draft-07/schema#",
   "title": "Person",
   "type": "object",

auth_volumes/kratos/identity.schema.json

@@ -107,8 +107,10 @@ hashers:
     cost: 8
 
 identity:
-  default_schema_id: default
+  default_schema_id: staff
   schemas:
+    - id: staff
+      url: file:///etc/config/kratos/staff.schema.json
     - id: default
       url: file:///etc/config/kratos/identity.schema.json
 

auth_volumes/kratos/kratos.yml

@@ -0,0 +1,49 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Staff",
+  "type": "object",
+  "properties": {
+    "traits": {
+      "type": "object",
+      "properties": {
+        "email": {
+          "type": "string",
+          "format": "email",
+          "title": "E-Mail",
+          "minLength": 3,
+          "pattern": "^.*@staffdomain\\.com$",
+          "ory.sh/kratos": {
+            "credentials": {
+              "password": {
+                "identifier": true
+              }
+            },
+            "verification": {
+              "via": "email"
+            },
+            "recovery": {
+              "via": "email"
+            }
+          }
+        },
+        "name": {
+          "type": "object",
+          "properties": {
+            "first": {
+              "title": "First Name",
+              "type": "string"
+            },
+            "last": {
+              "title": "Last Name",
+              "type": "string"
+            }
+          }
+        }
+      },
+      "required": [
+        "email"
+      ],
+      "additionalProperties": false
+    }
+  }
+}

auth_volumes/kratos/staff.schema.json

@@ -96,5 +96,10 @@ mutators:
       jwks_url: file:///etc/config/oathkeeper/id_token.jwks.json
       claims: |
         {
+          {{ if eq .Extra.identity.schema_id "staff" }}
+          {{ if .MatchContext.Header.Get "x-impersonate" }}
+          "impersonate": {{ .MatchContext.Header.Get "x-impersonate" | toJson }},
+          {{ end }}
+          {{ end }}
           "session": {{ .Extra | toJson }}
         }