shreemaan-abhishek opened a new pull request, #14030:
URL: https://github.com/apache/apisix/pull/14030
### Description
Upstream services that do not parse tokens need selected claims as plain
request headers. `openid-connect` can only forward whole tokens
(`X-Access-Token`, `X-ID-Token`, `X-Userinfo`). The common workaround is a
`serverless-pre-function` that decodes the token a second time, depends on
plugin priority, and has to clear spoofed headers itself.
This PR adds `upstream_headers`, a list of `{header, path}` mappings. `path`
is an array of keys, one per nesting level, so claim names containing `://`,
`/` or `.` work as is.
```json
"upstream_headers": [
{ "header": "X-Profile-Id", "path":
["https://example.com/claims/profile/id";] },
{ "header": "X-Org-Id", "path": ["org", "id"] }
]
```
- **Claim source**: only claims the plugin already verified.
- `bearer_only` / `public_key` / `use_jwks` / introspection: the verified
token payload or the introspection response.
- Authorization code flow: the ID token first, then userinfo for claims
the ID token lacks.
- **Spoofing**: every declared header is reset after authentication on every
outcome (success, deny, `unauth_action: pass`, multi-auth fallthrough). It
holds the verified claim or nothing.
- **Serialization**:
- strings as is
- numbers and booleans as text (integers printed in full)
- arrays of scalars joined by a space (an array `scope` becomes `read
write`)
- other arrays and objects as JSON
- missing, `null` or empty values set no header
- Routes without `upstream_headers` run no extra code.
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
