Gather detailed auth requirements

[suprjinx]

Assuming OIDC/JWT -- with groups claim or sub (owner) matching the domain name of the request.

But this may be complicated by service accounts or other auth types.

[GeorgeJahad]

with groups claim or sub (owner) matching the domain name of the request.

I considered both group and sub claims when implementing the OIDC primitives here: #49

The problem with groups is it doesn't give us the granularity we need for user specific policies.

While sub-claim matching is certainly doable, it wasn't clear to me for now where we would get the sub-id number to match against. So for now I just used email addresses, that users can include in their astral request.

We will need to investigate further with our users.

[dave-gantenbein]

Two questions:

1. How do users get the JWT?
2. How does Astral validate the token? Is there an extant library for this? Is it open source?

[GeorgeJahad]

being addressed by #68

[GeorgeJahad]

#68 is done so i think we can close this one