Hi folks how would one create an access rule that use `oauth Ory Community #talk-oathkeeper

Hi folks, how would one create an access rule that...

mammoth-country-5949

03/14/2023, 5:16 PM

Hi folks, how would one create an access rule that use

oauth2_introspection

Authenticator and

remote_json

Authorizer? Basically, I’d like to use the

sub

field in Hydra’s introspection response as the

Subject

calling into Keto’s check API.

witty-midnight-20567

03/15/2023, 11:23 AM

what is your usecase? asking because I might be interested in achieving something similar. - to replace pomerium (oauth-proxy) with ory: https://github.com/ory/oathkeeper/discussions/1075

mammoth-country-5949

03/15/2023, 10:13 PM

So it seems that this happens automatically. The documentation (https://www.ory.sh/docs/oathkeeper/pipeline/authn#oauth2_introspection) suggests:

The subject is extracted from the
username
field.

When I run a Hydra token through introspection endpoint (http://ory-hydra-admin:4445/admin/oauth2/introspect), I see something like this (and this is what OathKeeper gets back):

Copy code

{
  "active": true,
  "scope": "kafka",
  "client_id": "e31f3c03-80bc-4918-a0fa-afe9f433b400",
  "sub": "e31f3c03-80bc-4918-a0fa-afe9f433b400",
  "exp": 1678920413,
  "iat": 1678916813,
  "nbf": 1678916813,
  "aud": [],
  "iss": "<https://public.hydra.mydomain.com>",
  "token_type": "Bearer",
  "token_use": "access_token"
}

There is no

username

from which the

Subject

can be set, but there is the

sub

field which is the actual client id.

mammoth-country-5949

03/15/2023, 10:18 PM

So although the documentation is not correct, the code reveals that it’s indeed the

sub

filed that gets copied to the session object (https://github.com/ory/oathkeeper/blob/master/pipeline/authn/authenticator_oauth2_introspection.go#L274)

mammoth-country-5949

03/15/2023, 10:22 PM

My use-case is system to system integration where a client acquires a token from Hydra and use that token to call another system’s APIs whilst passing that token. The API call gets authorized by: 1- Validating token through Hydra’s introspection endpoint (which resolves the above JSON object) 2- Fine-grained authorization through Keto in which the client id of the caller is used the subject of a Query Tuple

7 Views

Open in Slack

Previous Next