How to authorize user using username OR sub claim instead of email address

[cpatel-secureauth]

I have tested authentication successfully as Email which is within a Vouch Proxy managed domain.

To avoid below error , I was looking for something which I can authorize user using Username OR Sub claim.

{"level":"warn","ts":1629395919.9066803,"msg":"/auth User is not authorized: verifyUser: Email is not within a Vouch Proxy managed domain

Is it possible?

[bnfinet]

@cpatel-secureauth that level of access control is not currently natively supported in Vouch Proxy.

There are some examples in #107 and other issues in the repository which show how to do it on the Nginx side with openresty.

[bnfinet]

@cpatel-secureauth feel free to continue the conversation here. If it becomes evident there's more to discuss I'm happy to reopen the issue.

[bnfinet]

#175 is a very similar request

[cpatel-secureauth]

I have figured out the way to authorize user using sub claim instead of email and its required to change code in openid provider.
If I create new provider called SecureAuth, can I use it like below in config.yml?

oauth:
provider: secureauth

[bnfinet]

@cpatel-secureauth have you seen #367 and #310. That's also sub focused.

Could you test #367 and see if that works for you?

[cpatel-secureauth]

I have created new provider called "secureauth" and tested sub focused authorization.
I'll create new pull request for new provider called "secureauth"

[bnfinet]

@cpatel-secureauth of course I understand why you'd like to have a new provider for secureauth but I'm hopeful that #367 might be a viable solution and allow secureauth to work within the bounds of provider: oidc.

Did you look at #367? What did you think?

Thanks again to you and SecureAuth for you interest in Vouch Proxy.

[cpatel-secureauth]

@bnfinet It is working as expected. I didn't see #367 before and I am glad that I was able to figure out my self.
Yes I have checked #367 and same thing I was trying in structs.go by define Username as Sub claim as per below.

// PrepareUserData implement PersonalData interface
func (u *User) PrepareUserData() {
if u.Username == "" {
u.Username = u.Sub
}
}