Using custom claims

Authentication and authorization tokens may contain user data (claims) that are not required by the Stormshield KMaaS.

Such data is placed in a “customClaims” object and can be used in an OPA policy file.

For example, the Stormshield KMaaS may get an authentication token of the following form:

Copy

{
    iss: 'issuer-authentication',
    aud: 'cse-authentication' ,
    exp: 1731599885,
    iat: 1728917885,
      email: 'user@domain.com',
      user_age: 23
 }

The "user_age" property is not required by the Stormshield KMaaS. However, it will be transmitted to OPA in a “customClaims” object, as follows:

Copy

{
    iss: 'issuer-authentication',
    aud: 'cse-authentication' ,
    exp: 1731599885,
    iat: 1728917885,
      email: 'user@domain.com',
      customClaims: {
          user_age: 23
      }
 }

You can use the "user_age" property in the policy.rego file, using the customClaims.{key} syntax. In the example below, access is restricted to users over the age of 18:

Copy

package cse
  
# Deny by default
default allow := false
  
# Allow access if age is more than 18
allow if {
  input.authentication.customClaims.user_age >= 18
}