Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Option to configure custom token user id claim #783

Merged
merged 7 commits into from
Sep 2, 2024
Merged

Conversation

FZambia
Copy link
Member

@FZambia FZambia commented Mar 8, 2024

Proposed changes

Add possibility to use alternative claim in token to extract user ID: token_user_id_claim option. At this moment due to how Centrifugo works with tokens it only supports user_id as alternative claim name. I.e the only possible way to enable the option is:

{
  ...
  "token_user_id_claim": "user_id"
}

Probably, in the future we can extend the option to support any custom claim, but that will require bigger refactoring.

By default Centrifugo uses sub to extract user ID - this is defined in JWT spec and should remain the recommended way to pass user ID, this should be emphasised in the documentation.

Setting alternative user id claim also affects subscription tokens, like any other token options. To use different config for subscription tokens Centrifugo provides separate_subscription_token_config option.

UPD. the description here is not quite actual anymore - see #783 (comment)

@s00d
Copy link

s00d commented Mar 12, 2024

It's a very necessary issue, but I needed it because of anonymous users. Now, it's impossible to pass an ID if the user is anonymous.

@FZambia
Copy link
Member Author

FZambia commented Mar 12, 2024

I needed it because of anonymous users. Now, it's impossible to pass an ID if the user is anonymous.

But anonymous users do not have user ID 🤔 That's why they are anonymous... Which user ID you wanted to use for them then? Usually for anonymous users you can use empty sub or use allow_anonymous_connect_without_token option. Probably I am missing sth?

BTW, the motivation here was to support a case when Centrifugo users already have JWT token infrastructure, already have sub inside tokens but it does not correspond to a proper user ID.

@FZambia
Copy link
Member Author

FZambia commented Sep 1, 2024

Updated pull request to support any configured defined claim to extract user ID from JWT. Custom claim must follow the following regexp at this point: ^[a-zA-Z_]+$.

So now instead just user_id the option may have other values:

"token_user_id_claim": "user_id"
"token_user_id_claim": "user"
"token_user_id_claim": "cf_user" 

@FZambia FZambia changed the title Token user id claim Option to configure custom token user id claim Sep 1, 2024
@FZambia FZambia merged commit bfee340 into master Sep 2, 2024
4 checks passed
@FZambia FZambia deleted the token_user_id_claim branch September 2, 2024 05:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants