Loading...

XML

Word

Printable

Blocked:
False
Ready:
False
3Scale PT Tested upstream:
Not Started
3scale PT Docs:
Not Started
3scale PT Product Specs:
Not Started
3scale PT Product Update Ready:
Not Started
3scale PT Released In Saas:
Not Started
3scale PT Verified Product:
Not Started
Target Release:

2.12.0 GA
Git Pull Request:
https://github.com/3scale/liquid-lua/pull/13
Steps to Reproduce:
Hide

Setup an SSO integration with an array of roles for client - adding a single role can be enough to trigger this behaviour

Configure JWT_Claim_Check policy to select one using liquid - eg: jwt.roles contains "foo:bar:baz"

Claim check will not pick up correct role
Show
Setup an SSO integration with an array of roles for client - adding a single role can be enough to trigger this behaviour Configure JWT_Claim_Check policy to select one using liquid - eg: jwt.roles contains "foo:bar:baz" Claim check will not pick up correct role

There appears to be a number of cases where the "contains" keyword in Liquid will fail to work correctly.

It appears that "contains" attempts to perform looping[1], however we do not allow loops in our liquid implementation[2]

[1]https://github.com/chenxianyu2015/liquid-lua/blob/58e0a197445300538adab021d574f9375ebb6eba/lib/liquid.lua#L2076-L2095

[2]https://github.com/3scale/APIcast/blob/e7f6ebbf15d1b053283f0d77ae7176e1c7bfcb44/gateway/src/apicast/template_string.lua#L72

relates to

THREESCALE-8384 JWT Claim Check Policy does not allow checking Client Claims of certain application IDs

links to

KCS