[Question] How to get path parameter during authorization? JWT audience claim in path for multi-tenant app #2923

Activity

1. robertdodd commented on Apr 10, 2023

   

   robertdodd

   on Apr 10, 2023

   Last edited by robertdodd

   Author

   More actions

   I think I figured it out, using a custom Authorizer. You still need to disable the audience claim check when decoding the JWT, but then the Authorizer will check the principal's tenant ID based on the path. Let me know if anyone has any feedback.

   type TenantAuthorizer struct {
   }
   
   func NewTenantAuthorizer() *TenantAuthorizer {
       return &TenantAuthorizer{}
   }
   
   func (a TenantAuthorizer) Authorize(req *http.Request, p interface{}) error {
       // cast principal to correct type
       var principal *models.Principal
       var ok bool
       if principal, ok = p.(*models.Principal); !ok {
           return errors.New("invalid principal, expected model.Principal type")
       }
   
       // TODO: if principal has SYSTEM/SERVICE scopes then return nil
   
       // use regex to get tenantID from `req.URL.Path`
       // NOTE: all paths must follow the same convention e.g. /tenants/:tenantID
       tenantID := getTenantIDFromRequest(req)
       if principal.TenantID != tenantID {
           return errors.New("not authenticated")
       }
   
       return nil
   }

   And in configuration file:

   api.APIAuthorizer = auth.NewTenantAuthorizer()
   
   api.OauthSecurityAuth = func(token string, scopes []string) (*models.Principal, error) {
       // decode JWT, disable audience claim verification, and return principal
   }
2. fredbi

   added

   question

   authAPI authenticationAPI authentication

   on Dec 22, 2023
3. fredbi

   added

   doc

   on Jun 28, 2026