User guide: Token normalization
Broadly, the term token normalization in authentication systems usually implies the exchange of an authentication token, as provided by the user in a given format, and/or its associated identity claims, for another freshly issued token/set of claims, of a given (normalized) structure or format.
The most typical use-case for token normalization involves accepting tokens issued by multiple trusted sources and of often varied authentication protocols, while ensuring that the eventual different data structures adopted by each of those sources are normalized, thus allowing to simplify policies and authorization checks that depend on those values. In general, however, any modification to the identity claims can be for the purpose of normalization.
This user guide focuses on the aspect of mutation of the identity claims resolved from an authentication token, to a certain data format and/or by extending them, so that required attributes can thereafter be trusted to be present among the claims, in a desired form. For such, Authorino allows to extend resolved identity objects with custom attributes (custom claims) of either static values or with values fetched from the Authorization JSON.
For not only normalizing the identity claims for purpose of writing simpler authorization checks and policies, but also getting Authorino to issue a new token in a normalized format, check the Festival Wristband tokens feature.
Authorino features in this guide:Check out as well the user guides about [Authentication with API keys](./api-key-authentication.md), [OpenID Connect Discovery and authentication with JWTs](./oidc-jwt-authentication.md) and [Simple pattern-matching authorization policies](./user-guides/json-pattern-matching-authorization.md). For further details about Authorino features in general, check the [docs](./../features.md).
- Kubernetes server
- Auth server / Identity Provider (IdP) that implements OpenID Connect authentication and OpenID Connect Discovery (e.g. Keycloak)
- jq, to extract parts of JSON responses
Create a containerized Kubernetes server locally using Kind:
Deploy a Keycloak server preloaded with all the realm settings required for this guide:
1. Install the Authorino Operator
2. Deploy the Talker API
The Talker API is just an echo API, included in the Authorino examples. We will use it in this guide as the service to be protected with Authorino.
3. Deploy Authorino
The command above will deploy Authorino as a separate service (as opposed to a sidecar of the protected API and other architectures), in
namespaced reconciliation mode, and with TLS termination disabled. For other variants and deployment options, check out the Getting Started section of the docs, the Architecture page, and the spec for the
Authorino CRD in the Authorino Operator repo.
4. Setup Envoy
The following bundle from the Authorino examples (manifest referred in the command below) is to apply Envoy configuration and deploy Envoy proxy, that wire up the Talker API behind the reverse-proxy and external authorization with the Authorino instance.
For details and instructions to setup Envoy manually, see Protect a service > Setup Envoy in the Getting Started page. For a simpler and straightforward way to manage an API, without having to manually install or configure Envoy and Authorino, check out Kuadrant.
The bundle also creates an
Ingress with host name
talker-api-authorino.127.0.0.1.nip.io, but if you are using a local Kubernetes cluster created with Kind, you need to forward requests on port 8000 to inside the cluster in order to actually reach the Envoy service:
5. Create the
This example implements a policy that only users bound to the
admin role can send
The config trusts access tokens issued by a Keycloak realm as well as API keys labeled specifically to a selected group (
friends). The roles of the identities handled by Keycloak are managed in Keycloak, as realm roles. Particularly, users
peter are bound to the
member role, while user
jane is bound to roles
admin. As for the users authenticating with API key, they are all bound to the
Without normalizing identity claims from these two different sources, the policy would have to handle the differences of data formats with additional ifs-and-elses. Instead, the config here uses the
identity.extendedProperties option to ensure a custom
roles (Array) claim is always present in the identity object. In the case of Keycloak ID tokens, the value is extracted from the
realm_access.roles claim; for API key-resolved objects, the custom claim is set to the static value
kubectl apply -f -<<EOF apiVersion: authorino.kuadrant.io/v1beta2 kind: AuthConfig metadata: name: talker-api-protection spec: hosts: - talker-api-authorino.127.0.0.1.nip.io authentication: "keycloak-kuadrant-realm": jwt: issuerUrl: http://keycloak.keycloak.svc.cluster.local:8080/auth/realms/kuadrant overrides: "roles": selector: auth.identity.realm_access.roles "api-key-friends": apiKey: selector: matchLabels: group: friends credentials: authorizationHeader: prefix: APIKEY defaults: "roles": value: ["admin"] authorization: "only-admins-can-delete": when: - selector: context.request.http.method operator: eq value: DELETE patternMatching: patterns: - selector: auth.identity.roles operator: incl value: admin EOF
6. Create an API key
7. Consume the API
Obtain an access token and consume the API as Jane (admin)
Obtain an access token with the Keycloak server for Jane:
AuthConfig deployed in the previous step is suitable for validating access tokens requested inside the cluster. This is because Keycloak's
iss claim added to the JWTs matches always the host used to request the token and Authorino will later try to match this host to the host that provides the OpenID Connect configuration.
Obtain an access token from within the cluster for the user Jane, whose e-mail has been verified:
If otherwise your Keycloak server is reachable from outside the cluster, feel free to obtain the token directly. Make sure the host name set in the OIDC issuer endpoint in the
AuthConfig matches the one used to obtain the token and is as well reachable from within the cluster.
Consume the API as Jane:
Obtain an access token and consume the API as John (member)
Obtain an access token with the Keycloak server for John:
Consume the API as John:
Consume the API using the API key to authenticate (admin)
If you have started a Kubernetes cluster locally with Kind to try this user guide, delete it by running:
Otherwise, delete the resources created in each step:
kubectl delete secret/api-key-1 kubectl delete authconfig/talker-api-protection kubectl delete authorino/authorino kubectl delete -f https://raw.githubusercontent.com/kuadrant/authorino-examples/main/envoy/envoy-notls-deploy.yaml kubectl delete -f https://raw.githubusercontent.com/kuadrant/authorino-examples/main/talker-api/talker-api-deploy.yaml kubectl delete namespace keycloak
To uninstall the Authorino Operator and manifests (CRDs, RBAC, etc), run: