Configurable Keto variables

auth/src/main/java/feast/auth/authorization/Keto/KetoAuthorizationProvider.java

@@ -33,20 +33,22 @@
 public class KetoAuthorizationProvider implements AuthorizationProvider {
 
   private final EnginesApi apiInstance;
+  private final Map<String, Object> options;
 
   /**
    * Initializes the KetoAuthorizationProvider
    *
    * @param options String K/V pair of options to initialize the provider with. Expects at least a
    *     "basePath" for the provider URL
    */
-  public KetoAuthorizationProvider(Map<String, String> options) {
+  public KetoAuthorizationProvider(Map<String, Object> options) {
     if (options == null) {
       throw new IllegalArgumentException("Cannot pass empty or null options to KetoAuth");
     }
     ApiClient defaultClient = Configuration.getDefaultApiClient();
-    defaultClient.setBasePath(options.get("basePath"));
+    defaultClient.setBasePath((String) options.get("basePath"));
     this.apiInstance = new EnginesApi(defaultClient);
+    this.options = options;
   }
 
   /**
@@ -57,20 +59,28 @@ public KetoAuthorizationProvider(Map<String, String> options) {
    * @return AuthorizationResult result of authorization query
    */
   public AuthorizationResult checkAccess(String project, Authentication authentication) {
-    String email = getEmailFromAuth(authentication);
+    String subject = (String) this.options.get("subject");
+    if ((subject == null) || (subject.isEmpty())) subject = "email";
+    String subjectValue = getSubjectFromAuth(authentication, subject);
     try {
       // Get all roles from Keto
       List<OryAccessControlPolicyRole> roles =
-          this.apiInstance.listOryAccessControlPolicyRoles("glob", 500L, 500L, email);
+          this.apiInstance.listOryAccessControlPolicyRoles("glob", 500L, 500L, subjectValue);
+      List<String> roleTemplates = (List<String>) this.options.get("roles");
 
-      // Loop through all roles the user has
-      for (OryAccessControlPolicyRole role : roles) {
-        // If the user has an admin or project specific role, return.
-        if (("roles:admin").equals(role.getId())
-            || (String.format("roles:feast:%s-member", project)).equals(role.getId())) {
-          return AuthorizationResult.success();
+      for (String roleTemplate : roleTemplates) {
+        if (roleTemplate.contains("{PROJECT}")) {
+          roleTemplate = roleTemplate.replace("{PROJECT}", project);
+        }
+        // Loop through all roles the user has
+        for (OryAccessControlPolicyRole role : roles) {
+          // If the user has a role matching one of the templates, return.
+          if ((roleTemplate).equals(role.getId())) {
+            return AuthorizationResult.success();
+          }
         }
       }
+
     } catch (ApiException e) {
       System.err.println("Exception when calling EnginesApi#doOryAccessControlPoliciesAllow");
       System.err.println("Status code: " + e.getCode());
@@ -80,27 +90,32 @@ public AuthorizationResult checkAccess(String project, Authentication authentica
     }
     // Could not determine project membership, deny access.
     return AuthorizationResult.failed(
-        String.format("Access denied to project %s for user %s", project, email));
+        String.format("Access denied to project %s for user %s", project, subjectValue));
   }
 
   /**
    * Get user email from their authentication object.
    *
    * @param authentication Spring Security Authentication object, used to extract user details
+   * @param subject Subject from the Auth token
    * @return String user email
    */
-  private String getEmailFromAuth(Authentication authentication) {
+  private String getSubjectFromAuth(Authentication authentication, String subject) {
     Jwt principle = ((Jwt) authentication.getPrincipal());
     Map<String, Object> claims = principle.getClaims();
-    String email = (String) claims.get("email");
+    String subjectValue = (String) claims.get(subject);
 
-    if (email.isEmpty()) {
-      throw new IllegalStateException("JWT does not have a valid email set.");
+    if (subjectValue.isEmpty()) {
+      throw new IllegalStateException(String.format("JWT does not have a valid %s.", subject));
     }
-    boolean validEmail = (new EmailValidator()).isValid(email, null);
-    if (!validEmail) {
-      throw new IllegalStateException("JWT contains an invalid email address");
+
+    if (subject.equals("email")) {
+      boolean validEmail = (new EmailValidator()).isValid(subjectValue, null);
+      if (!validEmail) {
+        throw new IllegalStateException("JWT contains an invalid email address");
+      }
     }
-    return email;
+
+    return subjectValue;
   }
 }

auth/src/main/java/feast/auth/config/SecurityProperties.java

@@ -54,6 +54,6 @@ public static class AuthorizationProperties {
     private String provider;
 
     // K/V options to initialize the provider with
-    private Map<String, String> options;
+    private Map<String, Object> options;
   }
 }

core/src/main/resources/application.yml

@@ -94,6 +94,10 @@ feast:
       provider: none
       options:
         basePath: http://localhost:3000
+        subject: email
+        roles:
+          - role:feast:admin
+          - role:feast:{PROJECT}-member
 
 grpc:
   server: