LGTM

Hello @spacewander @goblain

if this issue is still open, please assign it to me,

possible solution:

To implement this feature, we can introduce a new configuration parameter in the OIDC auth plugin named claim_validators. This parameter will be a list of maps, each map representing a custom claim validator.

Each map will contain two keys: claim and matches. claim is a string representing the name of the custom claim that needs to be validated. matches is a list of strings representing the allowed values of the custom claim.

During the authentication process, the plugin will validate the custom claim against the allowed values specified in the claim_validators configuration. If the custom claim fails to match any of the allowed values, the plugin will return a 401 unauthorized response.

local function validate_custom_claim(claim_value, allowed_values)
    for _, v in ipairs(allowed_values) do
        if v == claim_value then
            return true
        end
    end

    return false
end

local function oidc_authenticate(conf, ...)
    -- ...
    local claim_validators = conf.claim_validators or {}

    for _, validator in ipairs(claim_validators) do
        local claim = validator.claim
        local matches = validator.matches or {}

        local claim_value = json.decode(claims[claim] or "{}")[1]
        if not validate_custom_claim(claim_value, matches) then
            return responses.send_HTTP_UNAUTHORIZED("Invalid custom claim")
        end
    end

    -- ...
end

With this implementation, the user can specify a list of custom claim validators in the claim_validators configuration. For example:

plugins:
- name: oidc
  config:
    client_id: YOUR_CLIENT_ID
    client_secret: YOUR_CLIENT_SECRET
    discovery: https://your-oidc-provider.com/.well-known/openid-configuration
    redirect_uri: http://your-redirect-uri.com
    claim_validators:
    - claim: someclaim
      matches:
      - foo
      - bar

This will ensure that the someclaim custom claim in the OIDC token matches either foo or bar. If it does not match any of these values, the plugin will return a 401 unauthorized response.

You could submit a PR with test added to it.

You could submit a PR with test added to it.

@spacewander please checkout #9068

I'l like this issue to be assigned to me if possible, thanks.

@monkeyDluffy6017

What is the status on this issue?

would you like to work on it @Visserr2 ?

What is the status of this issue?@shreemaan-abhishek

@shreemaan-abhishek cc