How-to: Authorize an access token containing custom authorities

[jgrandja]

Publish a guide on How-to: Authorize an access token containing custom authorities, e.g. roles, groups, permissions, etc.

• How-to: Customize the headers / claims in a JWT

Related gh-499

[ddubson]

@jgrandja - I'd like to work on this how-to. May I request this assignment?

[jgrandja]

Thanks @ddubson ! The issue is yours 👍

[ddubson]

Currently working on this issue, but I do want to clarify my assumption as to the outline of what is to be covered in this How-To. Here's what I'm thinking:

Outline

• Adding custom claims to JWT-based access tokens - starting with a more basic case of adding claims to every access token. Some of this is already covered in the UserInfo endpoint How-To, but I thought I'd cover it briefly again here.
• Adding custom claims with authorities to JWT-based access tokens - adding custom claims to access tokens containing various authorities (roles, groups, permissions, etc.)
  • Internal static user - define sample roles, demonstrate how to populate a custom claim with the defined roles per user
  • Google OIDC - reading in Google OIDC claims about resource owner permissions
  • GitHub OIDC - reading in GitHub OIDC claims about resource owner permissions

@jgrandja let me know your thoughts on this -- if there's anything I should add or subtract.

[jgrandja]

@ddubson I wouldn't bother with the Google OIDC and GitHub login as it would require setup on the provider side to return certain claims and would make the doc more complicated. Let's just focus on the User configured in the UserDetailsService and configure roles, groups, permissions there and show how to map them to the claims in the JWT access token.