JWT Role Extraction for WLCG IAM JWT

[merl1n0]

Hello to all,
I'm trying to derive a role from a WLCG JWT profile token.
The role should be extracted from the wlcg.groups claim which is defined an ordered list of group names prepended by a /.
Jwt Role Extraction cannot be used directly:

# {"postgrest":{"wlcg.groups": ["/groupa", "/groupb", "/groupa/subgroupa1","/groupa/subgroupa2"]}}
jwt-role-claim-key = ".postgrest.wlcg.groups[0]"

This would return /groupa, instead of groupa.

Is there any way to handle a similar case? (i.e. trim away the first character).

Alternatively, I could extract the role from the scope claim:

"scope": "foo bar role:groupa zoo xywz"

But again that would need an extraction operator more powerful than those currently provided for JWT Role Extraction.

[steve-chavez]

Hey @merl1n0,

@taimoorzaeem maybe we could have an underscore (_) to represent "any single character", like in the LIKE operator? Maybe that would be simpler than implementing the percentage % wildcard.

So for this case we could do:

jwt-role-claim-key = '.postgrest.wlcg.groups[?(@ == "_groupa")]'

[merl1n0]

Hi @taimoorzaeem, thanks,
the [?(@ == "_groupa")] would still set
jwt-role-claim-key = "/groupa" ( the == , ^== , ... operators all select the first matching array element, not a part of it).

What I would need in this case would be something like:
jwt-role-claim-key = '.postgrest.wlcg.groups[0][1:], i.e. ltrim('/groupa','/');

[edit]
In WLCG profile, only the first array element of the wlcg.group claim is considered, hence there is no real need to inspect the other ones.

[taimoorzaeem]

Hi @merl1n0, thanks for clarifying. I understand the use case now. I think we can support a slice operator like [1:] on string values. @steve-chavez WDYT?

[steve-chavez]

I think we can support a slice operator like [1:0] on string values. @steve-chavez WDYT?

@taimoorzaeem Yes, agree.

[merl1n0]

hi, that would be great and set me fine for that use case! Thanks!

[develop7]

Is there any other software in your stack that is a subject to this quirk too and how is it handled by them?

[merl1n0]

That's quite a niche use case; WLCG services have been adopting X509 voms-proxy for auth*zn until recently. Those are replaced by IAM JWT, and the "wlcg.groups" claim just reflects the syntax of the FQAN (Fully Qualified Attribute Name) used in voms, which fundamentally keep the same meaning.

[steve-chavez]

@merl1n0 Can you share what authentication system do you use (the one that produces WLCG JWT profiles)? It'd be useful to mention this on the docs.

[merl1n0]

@steve-chavez There is a rather large family of such issuers. Refer to https://wlcg-authz-wg.github.io/wlcg-authz-docs/token-based-authorization/ . The assumption here is that You are member of a scientific experiment on High Energy Physics or Astro-particle/Grav. Waves Physics, involved in Grid computing. These IAM tokens define access to computing/storage resources to batch jobs (or data management services) on behalf of the token owner. Part of the authorization logic here depends on what group (Virtual Organization, in WLCG Jargon) the user belongs to. This can be retrieved from the first element of the "wlcg.groups" claim, witch has the form "/". That originated my request.