Remote JSON example

[rezakazemi928]

Hi.
I am really keen on using Oathkeeper authorization in my project, and I need a little help to code.
I want to use the remote JSON. However, It is not clear how can I send the payload along with my authorization remote Link. Would you mind give me some specifics about the configurations in the YML file, please?
Thanks

[vinckr]

Hey,
Are you asking how to configure the oathkeeper.yml to use remote JSON?
Can you give me some details on the "authorization remote Link"? What is this exactly?

There are some examples in the docs, but you probably already did not find what you are looking for in there.
The authorizer makes a HTTP POST request to a remote endpoint with a JSON body.
Payload:
payload (string, required) - The request's JSON payload sent to the remote authorizer. The string will be parsed by the Go text/template package and applied to an AuthenticationSession object. See Session for more details.

[rezakazemi928]

Thank you so much for your response.
Sure,
I have a link for my access rule which I coded myself with flask API. it would send a post request and check the request body with my access rules template.
something like this:

"identity_users": [
            {
                "id": "fd5f2992-a4fe-4b08-ae41-9619aa24bd71",
                "username": "reza7898"
            }
        ],
        "identity_groups": [],
        "id": "face9adf-c703-4f98-b15f-5a7d673ddc70"

and my config file for Oauthkeeper:

authorizers:
  allow:
    enabled: true
  remote_json:
    enabled: true
    config:
      remote: http://127.0.0.1:5000/api/accessrules/authorization # or the docker container IP address
      payload: "{}"

I do not know what should I do in the payload field in my case.
I read the documentation, but still, I am a little confused.

[vinckr]

How does your rules.json look?

E.g. radeks docker compose example

oathkeeper.yaml

authorizers:
    allow:
        enabled: true
    deny:
        enabled: true
    remote_json:
        # remote_json documentation: https://www.ory.sh/oathkeeper/docs/pipeline/authz#remote_json
        enabled: true
        config:
            remote: http://keto:4466/check
            # must be set explicitly, otherwise: https://github.com/ory/oathkeeper/issues/797
            forward_response_headers_to_upstream: []
            payload: |
                {
                    "namespace": "...",
                    "subject": "...",
                    "object": "...",
                    "relation": "..."
                }

rules.json

        "authorizer": {
            "handler": "remote_json",
            "config": {
                "remote": "http://keto:4466/check",
                "payload": "{\"namespace\": \"default-namespace\", \"subject\": \"{{ print .Subject }}\", \"object\": \"token:and:keto\", \"relation\": \"get\"}"
            }

[rezakazemi928]

here is my accessrule.yml

- id: c2996f85-cb18-43ad-8a75-b225863dd997
  upstream:
    preserve_host: true
    url: http://httpbin.org/
  match:
    url: http://127.0.0.1:4455/ip
    methods:
    - GET
    - POST
    - PUT
    - DELETE
    - PATCH
  authenticators:
  - handler: cookie_session
  authorizer:
    handler: remote_json
    config:
      remote: http://keto:4466/check
      payload: |
              {
                  "namespace": "default-namespace",
                  "subject": "{{ print .Subject }}",
                  "object": "reports",
                  "relation": "edit"
              }         
  mutators:
  - handler: id_token

But, I do not know why it is not working.

[vinckr]

Hey @rezakazemi928 , just checking in if your problem still persists.
I will mark this as answered for now, but feel free to come back to the discussion any time.
Thanks a ton 🐝