returning claims from user_info as X-Vouch-IdP-Claims-* headers

[rogerscuall]

Describe the problem
After the user was authenticated and can go to the protected service, the only information we have about the user is the header x-vouch-user. Can we get any other information assuming the external provider is sending that information?

Expected behavior
In this specific case, other information is requested, for scope is: OpenID, email, profile.
The auth response header is just x-vouch-user per the example in the main page:
nginx.ingress.kubernetes.io/auth-response-headers: x-vouch-user
But I'm looking for any other information that we can pass to the protected service, for example, the email or the profile.

Additional context
For testing purposes right now the protected service is httpbin and I'm getting the following headers:
https://hastebin.com/eyiroviyax.bash

[bnfinet]

Take a look at the config examples for how to pass claims as headers... https://github.com/vouch/vouch-proxy/blob/master/config/config.yml_example#L95-L103

…

On Sun, Mar 8, 2020 at 1:35 PM Roger Gomez Olivares < ***@***.***> wrote: *Describe the problem* After the user was authenticated and can go to the protected service, the only information we have about the user is the header *x-vouch-user*. Can we get any other information assuming the external provider is sending that information? *Expected behavior* In this specific case, other information is requested, for scope is: OpenID, email, profile. The auth response header is just x-vouch-user per the example in the main page: nginx.ingress.kubernetes.io/auth-response-headers: x-vouch-user But I'm looking for any other information that we can pass to the protected service, for example, the email or the profile. *Additional context* For testing purposes right now the protected service is httpbin and I'm getting the following headers: https://hastebin.com/eyiroviyax.bash — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#221?email_source=notifications&email_token=AAJUV23VWMPGJGAIPFWJ6PLRGQFSVA5CNFSM4LD4WPBKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4ITM4RXA>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJUV253Z7UJU2IPSUYOLW3RGQFSVANCNFSM4LD4WPBA> .

[rogerscuall]

Hi @bnfinet , thanks for your help.
I followed your link, now the vouch config looks like this:
https://gist.github.com/rogerscuall/bc1c44e5ff3033399d1af7eeed70e630
The ingress looks like this:
https://gist.github.com/rogerscuall/2945c48fc2190638b3544083f29c9995
The logs in vouch look like this:

2020-03-09T14:52:38.817Z	INFO	OpenID userinfo body: {"sub":"7a3071e7-59ed-4032-b345-e32adfbf859f","email_verified":"true","phone_number_verified":"true","phone_number":"+01813XXXXXXX","email":"[email protected]","username":"devtestqa1"}

But still not getting the header with the groups.
https://gist.github.com/rogerscuall/ddc1909993f7284629143f8db8547722
In this case the provider is AWS Cognito.
When I use the Cognito SDK after decrypting the JWT I get a field like this one: cognito:groups with the groups of the user.

[bnfinet]

please post your logs with loglevel: debug and testing: true

[rogerscuall]

One more time thanks.
This is the log:
https://hastebin.com/meyicuside.rb
On line 59 there is a JWT token decoding that will return something like this:

{
  "sub": "7a3071e7-59ed-4032-b345-e32adfbf859f",
  "cognito:groups": [
    "grouping"
  ],
...

[bnfinet]

If properly configured the CustomClaims:map[] should be getting populated (lines 153 and 121)

In the config headers should be a sub element of vouch. You have it on the same level as vouch and oauth

and I believe it will need to be

vouch:
  headers:
    claims:
    - cognito:groups

[rogerscuall]

You are completely right, my mistake. I can see now that in the vouch logs this line at the very beginning:
2020-03-12T02:33:36.485Z DEBUG viper settings map[vouch:map[testing:true headers:map[claims:[cognito:groups]]
I have applied the changes you requested but still the same issue, config looks like this:
https://hastebin.com/ihinedijus.m
Logs look like this:
https://hastebin.com/nesixuleto.pl
Reading again the documentation the header will take the name of X-Vouch-IdP-Claims-ClaimKey, if the claim key is cognito:groups what would be the name. I tried with groups, instead of cognito:groups with similar results, the field is still not present and the CustomClaims:map[] is still present in the logs.

[bnfinet]

Until #183 and #184 are resolved cognito:groups will not work. The : in the string screws up the header.

However I'm not sure that's what you're seeing here. It feels like we should be able to see the groups coming out of the JWT.

[rogerscuall]

Nope, I still get the CustomClaims:map[] empty. If I decrypt the JWT I can see:

{
  "sub": "7a3071e7-59ed-4032-b345-e32adfbf859f",
  "cognito:groups": [
    "grouping"
  ],
...

But the field with the group that is sent back to the protected service is missing.

[bnfinet]

hope this is fixed by #183 v0.10.0
@rogerscuall could you please test

[rogerscuall]

Thanks, I have tried it but I still get the CustomClaims:map[] empty on the logs and only the headers for X-Forwarded-Host, X-Vouch-User, and Cookie related to Vouch. I still don't see the additional header even though the logs have vouch:map[allowallusers:true domains:[dev.myexample.com] headers:map[claims:[cognito:groups]]

[bnfinet]

Could you post a fresh log with debug and your current nginx conf? I'm curious about the header syntax VP is suggesting in the logs.

…

On Wed, Apr 22, 2020, 7:02 AM Roger Gomez Olivares ***@***.***> wrote: Thanks, I have tried it but I still get the CustomClaims:map[] empty on the logs and only the headers for X-Forwarded-Host, X-Vouch-User, and Cookie related to Vouch. I still don't see the additional header even though the logs have vouch:map[allowallusers:true domains:[ dev.myexample.com] headers:map[claims:[cognito:groups]] — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#221 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJUV26SCR6GRKMNGNWBF5TRN32FZANCNFSM4LD4WPBA> .

[bnfinet]

@rogerscuall any progress on this one? If you are no longer working this issue could you please close it.