[THREESCALE-9510] Allow JWT Claim Check policy access to full request context when evaluate condition

[tkan145]

What

Fix https://issues.redhat.com/browse/THREESCALE-9510

Verification steps

• Checkout this branch and build a new runtime image

make runtime-image IMAGE_NAME=apicast-test

• Move into dev-environment

cd dev-environments/keycloak-env

• Edit apicast-config.json as follow

diff --git a/dev-environments/keycloak-env/apicast-config.json b/dev-environments/keycloak-env/apicast-config.json
index 071296cd..62fb24f5 100644
--- a/dev-environments/keycloak-env/apicast-config.json
+++ b/dev-environments/keycloak-env/apicast-config.json
@@ -90,6 +90,20 @@
               "auth_type": "use_3scale_oidc_issuer_endpoint"
             }
           },
+          {
+            "name": "apicast.policy.jwt_claim_check",
+            "configuration": {
+              "rules" : [{
+                  "operations": [
+                    {"op": "==", "jwt_claim": "{{jwt.realm_access.roles| first}}", "jwt_claim_type": "liquid", "value": "{{original_request.query | split: \"role=\" | last}}", "value_type": "liquid"}
+                  ],
+                  "combine_op": "and",
+                  "methods": ["GET"],
+                  "resource": "/"
+              }],
+              "enable_extended_context": true
+            }
+          },
           {
             "name": "apicast",
             "version": "builtin",

• Start gateway and seed keycloak data

make gateway IMAGE_NAME=apicast-test
make keycloak-data

• Retrieve access token

export ACCESS_TOKEN=$(make token)

• Send a request and you should receive HTTP/1.1 200 OK

curl -v --resolve stg.example.com:8080:127.0.0.1 -H "Authorization: Bearer ${ACCESS_TOKEN}" "http://stg.example.com:8080/?role=default-roles-basic"

• Now send another request with query role=default-roles-basic3

curl -v --resolve stg.example.com:8080:127.0.0.1 -H "Authorization: Bearer ${ACCESS_TOKEN}" "http://stg.example.com:8080/?role=default-roles-basic3"

• HTTP/1.1 403 Forbidden should be returned

[eguzki]

Verification steps working.

LGTM

Not approved due to some comments I want to clarify on the doc side.

[eguzki]

Suggested change

	]
	],
	"enable_extended_context": true

[tkan145]

fixed

[eguzki]

Suggested change

	]
	],
	"enable_extended_context": true

[tkan145]

fixed

[eguzki]

only for liquid templating, isn't it? when plain templating is used, jwt. prefix is being added by the gateway

[tkan145]

yes, you are right. I updated the readme