Use ‘has’ operator with claim subpath in PPL

[robertgates55]

We're using dex as our IDP, which pulls user groups from google and passes these back as a user claim - the groups are not direct pomerium groups.

Is it possible to use the claim field with a subpath and the 'has' operator? I'd like to do something like this:

allow:
  and:
  - domain:
      is: du.co
  - claim/groups:
      has: mygroup

I've seen that I can combine with existing annotations, eg:

kind: Ingress
metadata:
  annotations:
    ingress.pomerium.io/allowed_idp_claims: |
      groups:
      - platform@du.co
    ingress.pomerium.io/policy: |
      allow:
        and:
        - domain:
            is: du.co

But this seems to apply the allowed_idp_claims policy as an OR with the policy... which isn't what I'm after.

Any options here?

[calebdoxsey]

@robertgates55 IDP claims are always a map of string keys to lists of values:

{
  "family_name": ["Doe"],
  "given_name": ["John"]
}

So the claim criterion implicitly uses the has operator. You should be able to create a policy by removing the has operator and just using the value directly:

allow:
  and:
  - domain:
      is: du.co
  - claim/groups: mygroup

The criterion should return true if any of the values in the list match the value. (in this case if any of the groups are mygroup)

Have you tried this?

[robertgates55]

Aha!

I had not, but that works perfectly - thanks.

Fwiw - I'd read the docs, and "if a token claim matches the supplied value exactly" had led me to think I'd need to string-match the whole array... I now see that that's not what it says. Might be worth clarifying though for future people, or maybe supporting the has matcher as well for consistency and policy readability?

[travisgroth]

Hi @robertgates55 do you have a suggestion on where/how we could clarify? We'd be glad for some input there.

[nhayfield]

@travisgroth I think he is just saying that we should support has/is as well as just : for consistency

[alexfornuto]

Closing per @desimone