Feature/global auth session

[Sbou]

Related issue

#292

Discussed with @aeneasr

Proposed changes

The AuthenticationSession is now global to all the life of the request handler.
The signature changes to:

type AuthenticationSession struct {
	Subject      string                 `json:"subject"`
	Extra        map[string]interface{} `json:"extra"`
	Header       http.Header            `json:"header"`
	MatchContext MatchContext           `json:"matchContext"`
}

type MatchContext struct {
	RegexpCaptureGroups []string `json:"regexpCaptureGroups"`
	URL                 *url.URL `json:"url"`
}

So it's now possible to use it in all authorizers or mutators.
For example with mutator_id_token

{"claims": "{\"custom-claim\": \"{{ print .Extra.abc }}\", \"custom-claim2\": \"{{ index .MatchContext.RegexpCaptureGroups 0 }}\", \"aud\": [\"foo\", \"bar\"]}"}

Checklist

• I have read the contributing guidelines
• I have read the security policy
• I confirm that this pull request does not address a security vulnerability. If this pull request addresses a security
  vulnerability, I confirm that I got green light (please contact [email protected]) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation within the code base (if appropriate)
• I have documented my changes in the developer guide (if appropriate)

Further comments

Should we keep compatibility with the ReplaceAllString syntax in the config of the keto_engine_acp_ory authorizer?

New syntax

{
  "handler": "keto_engine_acp_ory",
  "config": {
    "required_action": "my:action:{{ index .MatchContext.RegexpCaptureGroups 0 }}",
    "required_resource": "my:resource:{{ index .MatchContext.RegexpCaptureGroups 1 }}:foo:{{ index .MatchContext.RegexpCaptureGroups 0 }}"
  }
}

[aeneasr]

Hey, I haven't missed this - just a lot to do at the moment. Will review this in the next days!

[aeneasr]

Great job! This looks really solid! Before merging we need to update the docs also and (if I'm correct) and there's a breaking change update the rule migrator as well.

The docs should probably receive updates:

• https://www.ory.sh/docs/oathkeeper/pipeline/authz#configuration-2
• https://www.ory.sh/docs/oathkeeper/pipeline/mutator#claims
• https://www.ory.sh/docs/oathkeeper/pipeline/mutator#cookies
• https://www.ory.sh/docs/oathkeeper/pipeline/mutator#headers (might make sense to merge these into one section and just link to it)

[aeneasr]

I don't believe these are actually used in this test?

[aeneasr]

ping @Sbou :)

[Sbou]

I only use it in the "No Changes" test to validate that we don't lose this part in the serialization/deserialization step.

"No Changes": {
	Setup:   defaultRouterSetup(),
	Session: newAuthenticationSession(setExtra(sampleKey, sampleValue), setMatchContext(sampleCaptureGroups)),
	Rule:    &rule.Rule{ID: "test-rule"},
	Config:  defaultConfigForMutator(),
	Request: &http.Request{},
	Match:   newAuthenticationSession(setExtra(sampleKey, sampleValue), setMatchContext(sampleCaptureGroups)),
	Err:     nil,
},

[aeneasr]

The version this will be released (after merge) as is v0.37.0+oryOS.18

[aeneasr]

Thank you so much for your hard work (and sorry for my late review) - this looks perfect!

One thing is left before this can be merged, we need to update the documentation here:

• https://www.ory.sh/docs/oathkeeper/pipeline/authz#configuration-2
• https://www.ory.sh/docs/oathkeeper/pipeline/mutator#claims
• https://www.ory.sh/docs/oathkeeper/pipeline/mutator#cookies
• https://www.ory.sh/docs/oathkeeper/pipeline/mutator#headers (might make sense to merge these into one section and just link to it)

It would also be cool to have the new capabilities documented somewhere, maybe as a new section below here ( https://github.com/ory/docs/blob/master/docs/oathkeeper/api-access-rules.md#scoped-credentials )?

[aeneasr]

I’m sorry, I merged another PR which now gives a conflict here. As I don’t habe access to a PC right now, could you rebase/merge with master? Thank you for your hard work!

[Sbou]

@aeneasr I rebased the Pull Request.