stacklok / toolhive / 29749964578

push

github

Normalize opt-in multi-valued JWT claims for Cedar (#5880)

OAuth scope claims arrive in different shapes across identity providers:
Entra and Keycloak emit them as one space-delimited string, while Okta
emits a JSON array. The Cedar authorizer maps a string to a Cedar String
and an array to a Set, and no single policy expression matches element
membership across both shapes — a type mismatch errors and the policy is
silently ignored, so a policy authored for one IdP fails closed for
another.

Add an opt-in MultiValuedClaims config field naming the JWT claims to
normalize. For each listed claim, the authorizer exposes two forms:

  - claim_<name> is normalized to a space-delimited string (arrays are
    joined, strings pass through unchanged) so existing string-membership
    policies match uniformly across IdPs; and
  - a companion Cedar Set is exposed as claimset_<name> for exact-element
    membership via contains/containsAll/containsAny.

Both surface on the principal entity and the request context. The
claimset_ prefix is reserved and cannot be shadowed by a JWT claim, since
all claims are prefixed with claim_. The field is opt-in: with it empty,
output is byte-identical to before, so existing deployments are unaffected.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

57 of 65 new or added lines in 1 file covered. (87.69%)

75301 of 109561 relevant lines covered (68.73%)

71.46 hits per line