jwt claims_map

[cdgipson]

I have the following configuration for claims_map.

"claims_map": { "x-hasura-default-role": { "path": "$$.x-hasura-default-role" }, "x-hasura-allowed-roles": { "path": "$$.x-hasura-allowed-roles" }, "x-hasura-user-id": { "path": "$$.sub" } }

This allows me to map the claims to the root of my token. This works well when I am running under the context of a user. However, when I run under the context of an application, there is no sub claim. Is there a way to map the sub claim if it is found, otherwise use the client_id claim?

Here is an example of the token when run under the context of a user.
{ "nbf": 1656596825, "exp": 1656600425, "iss": "xxxxxxxx", "aud": "hasura", "client_id": "architecttest-client", "sub": "92166fa4-1585-4a8b-b4c7-d3ec128d5167", "auth_time": 1656596821, "idp": "Microsoft", "x-hasura-allowed-roles": [ "public", "admin" ], "x-hasura-default-role": "admin", "scope": [ "hasura" ], "amr": [ "external" ] }

Here is an example token when run under the context of the application.

{ "nbf": 1656597399, "exp": 1656600999, "iss": "xxxxxxxx", "aud": "hasura", "client_id": "architecttest-client", "x-hasura-default-role": "admin", "x-hasura-allowed-roles": [ "admin", "public" ], "scope": [ "hasura" ] }

[BenoitRanque]

Conditionally mapping a single claim isn't possible.

However, for your particular use case, we can suggest the following configuration:

        {
          "claims_map": {
            "x-hasura-default-role": { "path": "$$.x-hasura-default-role" },
            "x-hasura-allowed-roles": { "path": "$$.x-hasura-allowed-roles" },
            "x-hasura-user-id": { "path": "$$.sub", "default": "" },
            "x-hasura-client-id": { "path": "$$.client_id", "default": "" }
          }
        }

This configuration will allow you to parse auth tokens with or without client_id and sub claims.
When the claims are absent, they would default to empty strings.

To avoid issues in your permissions, you should define different roles, for example user and machine.
Then, your permissions would be defined on a per-role basis, where each role would only use the claims guaranteed to be present with said role.

[cdgipson]

Thanks for this information. I can then use the x-hasura-user-id or x-hasura-client-id.