jakubmatyszewski opened a new pull request, #20222:
URL: https://github.com/apache/druid/pull/20222
## Description
PR #18259 (pac4j extension upgrade) dropped the `AuthenticationResult`
context by passing `null` when building the result in `Pac4jFilter`. Prior to
that upgrade (see #16109), the full `UserProfile` object was stored in the
context under the key `"profile"`.
This change restores the capability: the profile's **attributes map**
(`profile.getAttributes()`) is stored under `context.profile.attributes`. Using
a plain `Map<String, Object>` rather than the `UserProfile` object directly
makes it:
- Serialization-friendly (no pac4j-specific types on the wire)
- Usable by external authorizers that forward the `AuthenticationResult` as
JSON (e.g. OPA-based authorizers)
## Motivation
Without this, downstream authorizers cannot make attribute-based access
decisions from OIDC claims (e.g. group membership). A user authenticated via
Okta OIDC will have `context: null` in their `AuthenticationResult`, making it
impossible to distinguish group membership from the authorization layer.
## Changes
- `Pac4jFilter`: populate `AuthenticationResult` context with `{profile:
{attributes: <profile.getAttributes()>}}` instead of `null`
- `Pac4jFilterTest`: add test verifying the context shape and that group
attributes are accessible
## Test
Added `testAuthenticationResultContainsProfileAttributes` to
`Pac4jFilterTest` which creates a `CommonProfile` with group attributes and
verifies the resulting `AuthenticationResult` context has the expected
structure.
This issue was originally introduced in:
https://github.com/apache/druid/pull/18259
The original addition was in: https://github.com/apache/druid/pull/16109
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
