Can I please see a practivcal example for ClaimAssertion?

[ovizii]

I looked at the examples here: https://traefik-oidc-auth.sevensolutions.cc/docs/getting-started/middleware-configuration#claim-assertion but those are all about books and colours. I need a practical example how I would filter in a middleware config to only allow say a user in a specific group to pass.

I tried this, but it does not seem to work:

          ClaimAssertion:
            - name: "groups"
              allOf: ["admins"]

[sevensolutions]

Hi @ovizii
your config looks ok but it requires your token to contain a claim called "groups". If you enable debug logging in the middleware you should see the available claims in the console.

Btw: Which provider are you using?
Depending on your provider, you may need to map this information into your token first.

Edit: Oh sorry your config is wrong:

Authorization:
  AssertClaims:
    - name: "groups"
      allOf: ["admins"]

[ovizii]

Edit: Oh sorry your config is wrong:

Thanks for catching that, let me give it another try. And it worked!

I am using Pocket ID as IDP.
I checked: https://idp.domain.tld/.well-known/openid-configuration

and I see:

{
  "authorization_endpoint": "https://idp.domain.tld/authorize",
  "claims_supported": [
    "sub",
    "given_name",
    "family_name",
    "name",
    "email",
    "email_verified",
    "preferred_username",
    "picture",
    "groups"
  ],
...

I have a website I only want to allow access to if the user logging in is in the group called users.
So the config I used was this:

          Authorization:
            AssertClaims:
              - Name: "groups"
                allOf: ["users"]

And then I chose a passkey which belongs to a user who is only in the admins group and I got: access denied :-)

Some constructive feedback about your documentation, and please don't take it the wrong way but without your help here, the docs would not have been enough.

I had to read that page https://traefik-oidc-auth.sevensolutions.cc/docs/getting-started/middleware-configuration#claim-assertion at least a dozen times and still got it wrong. Now that I see your example, it all makes sense. I found it totally confusing, not having a proper example to look at its entirety. I didn't realize AssertClaims goes below Authorization and the examples were not about OIDC but about some web-store JSON and only showing snippets without the AssertClaims and Authorization this was hard to figure out.

[sevensolutions]

Yeah sorry. I fully agree with you that the documentation isn't good at this point. Some practical examples would be much better here and I've already opened #117 to improve this.

Glad that it's working for you now 😁