Make user and role claim names configurable

Add user-claim and role-claim properties to the
org.opendaylight.aaa.shiro.bearerjwtrealm configuration PID so that
operators can adapt the realm to identity providers that use different
JWT claim names (e.g. sub/groups instead of preferred_username/roles).

JIRA: AAA-299
Change-Id: Iccc9e481cfc852d10551747aa7721e6e39845cad
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Ivan Hrasko <ivan.hrasko@pantheon.tech>
Signed-off-by: Samuel Schneider <samuel.schneider@pantheon.tech>

Author: 2 people

aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/BearerJwtRealm.java

@@ -26,6 +26,7 @@
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;
+import org.eclipse.jdt.annotation.NonNull;
 import org.eclipse.jdt.annotation.Nullable;
 import org.opendaylight.aaa.api.shiro.principal.ODLPrincipal;
 import org.opendaylight.aaa.shiro.principal.ODLPrincipalImpl;
@@ -49,16 +50,21 @@
  */
 public final class BearerJwtRealm extends AuthorizingRealm {
     private static final Logger LOG = LoggerFactory.getLogger(BearerJwtRealm.class);
-    // TODO make this configurable for different identity providers
-    private static final String USER_CLAIM = "preferred_username";
-    private static final String ROLE_CLAIM = "groups";
-    private static final ThreadLocal<JWTProcessor<SecurityContext>> PROCESSOR_TL = new ThreadLocal<>();
+    private static final ThreadLocal<BearerJwtRealmConfig> CONFIG_TL = new ThreadLocal<>();
+
+    static final String DEFAULT_USER_CLAIM = "preferred_username";
+    static final String DEFAULT_ROLE_CLAIM = "groups";
 
     private final @Nullable JWTProcessor<SecurityContext> jwtProcessor;
+    private final @NonNull String userClaim;
+    private final @NonNull String roleClaim;
 
     public BearerJwtRealm() {
         setAuthenticationTokenClass(BearerToken.class);
-        this.jwtProcessor = PROCESSOR_TL.get();
+        final var config = CONFIG_TL.get();
+        jwtProcessor = config != null ? config.jwtProcessor() : null;
+        userClaim = config != null ? config.userClaim() : DEFAULT_USER_CLAIM;
+        roleClaim = config != null ? config.roleClaim() : DEFAULT_ROLE_CLAIM;
         if (jwtProcessor == null) {
             LOG.warn("No JWT verification configured — BearerJwtRealm accepting unverified Bearer tokens");
         }
@@ -74,8 +80,8 @@ public BearerJwtRealm() {
      * @return a {@link Registration} that cleans up the thread-local when closed
      */
     public static Registration prepareForLoad(final BearerJwtRealmConfig config) {
-        PROCESSOR_TL.set(config != null ? config.jwtProcessor() : null);
-        return PROCESSOR_TL::remove;
+        CONFIG_TL.set(config);
+        return CONFIG_TL::remove;
     }
 
     @Override
@@ -89,7 +95,7 @@ protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken t
 
         final String username;
         try {
-            username = claims.getStringClaim(USER_CLAIM);
+            username = claims.getStringClaim(userClaim);
         } catch (ParseException e) {
             throw new AuthenticationException("Invalid JWT user claim data", e);
         }
@@ -99,9 +105,9 @@ protected AuthenticationInfo doGetAuthenticationInfo(final AuthenticationToken t
 
         final Set<String> roles;
         try {
-            roles = parseRoles(claims);
+            roles = parseRoles(claims, roleClaim);
         } catch (ParseException e) {
-            throw new AuthenticationException("Invalid JWT groups claim data", e);
+            throw new AuthenticationException("Invalid JWT role claim data", e);
         }
 
         final var odlPrincipal = ODLPrincipalImpl.createODLPrincipal(username, null, username, roles);
@@ -138,8 +144,8 @@ private JWTClaimsSet parseClaims(final String token) {
         }
     }
 
-    private static Set<String> parseRoles(final JWTClaimsSet claims) throws ParseException {
-        final var groups = claims.getStringListClaim(ROLE_CLAIM);
+    private static Set<String> parseRoles(final JWTClaimsSet claims, final String roleClaim) throws ParseException {
+        final var groups = claims.getStringListClaim(roleClaim);
         if (groups == null) {
             LOG.warn("JWT has no roles claim; granting no roles");
             return Set.of();

aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/BearerJwtRealmConfig.java

@@ -9,6 +9,7 @@
 
 import com.nimbusds.jose.proc.SecurityContext;
 import com.nimbusds.jwt.proc.JWTProcessor;
+import org.eclipse.jdt.annotation.NonNull;
 import org.eclipse.jdt.annotation.Nullable;
 
 /**
@@ -20,4 +21,14 @@ public interface BearerJwtRealmConfig {
      * {@return JWTProcessor if configured}
      */
     @Nullable JWTProcessor<SecurityContext> jwtProcessor();
+
+    /**
+     * {@return configured JWT claim name used to extract the username}
+     */
+    @NonNull String userClaim();
+
+    /**
+     * {@return configured claim name used to extract the list of roles}
+     */
+    @NonNull String roleClaim();
 }

aaa-shiro/impl/src/main/java/org/opendaylight/aaa/shiro/realm/BearerJwtRealmConfigImpl.java

@@ -7,6 +7,8 @@
  */
 package org.opendaylight.aaa.shiro.realm;
 
+import static java.util.Objects.requireNonNull;
+
 import com.google.common.annotations.VisibleForTesting;
 import com.nimbusds.jose.JWSAlgorithm;
 import com.nimbusds.jose.jwk.source.JWKSource;
@@ -23,6 +25,7 @@
 import java.util.Arrays;
 import java.util.Set;
 import java.util.stream.Collectors;
+import org.eclipse.jdt.annotation.NonNull;
 import org.eclipse.jdt.annotation.Nullable;
 import org.osgi.service.component.annotations.Activate;
 import org.osgi.service.component.annotations.Component;
@@ -41,10 +44,12 @@
  *
  * <p>Configuration is supplied via {@code etc/org.opendaylight.aaa.shiro.bearerjwtrealm.cfg}:
  * <pre>{@code
- * jwks-uri=http(s)://keycloak.local:8080/realms/odl-realm/protocol/openid-connect/certs
- * expected-issuer=http(s)://keycloak.local:8080/realms/odl-realm
- * expected-audience=odl-application
- * allowed-algorithms=RS256
+ * jwks-uri="http(s)://keycloak.local:8080/realms/odl-realm/protocol/openid-connect/certs"
+ * expected-issuer="http(s)://keycloak.local:8080/realms/odl-realm"
+ * expected-audience="odl-application"
+ * allowed-algorithms=["RS256", "RS384", "RS512", "ES256"]
+ * user-claim="preferred_username"
+ * role-claim="groups"
  * }</pre>
  */
 @Component(service = BearerJwtRealmConfig.class, configurationPid = "org.opendaylight.aaa.shiro.bearerjwtrealm")
@@ -73,16 +78,29 @@ Expected value(s) of the 'aud' JWT claim (comma-separated).
         @AttributeDefinition(description = """
             Allowed JWS signing algorithms (comma-separated, e.g. RS256, RS384, RS512, ES256).""")
         String[] allowed$_$algorithms() default {"RS256", "RS384", "RS512", "ES256"};
+
+        @AttributeDefinition(description = """
+            JWT claim name used to extract the username.""")
+        String user$_$claim() default BearerJwtRealm.DEFAULT_USER_CLAIM;
+
+        @AttributeDefinition(description = """
+            JWT claim name used to extract the list of roles.""")
+        String role$_$claim() default BearerJwtRealm.DEFAULT_ROLE_CLAIM;
     }
 
     private final @Nullable JWTProcessor<SecurityContext> jwtProcessor;
+    private final @NonNull String userClaim;
+    private final @NonNull String roleClaim;
 
     /**
      * Package-private constructor for use in unit tests, accepting a pre-built processor.
      */
     @VisibleForTesting
-    BearerJwtRealmConfigImpl(final @Nullable JWTProcessor<SecurityContext> jwtProcessor) {
+    BearerJwtRealmConfigImpl(final @Nullable JWTProcessor<SecurityContext> jwtProcessor,
+            final @NonNull String userClaim, final @NonNull String roleClaim) {
         this.jwtProcessor = jwtProcessor;
+        this.userClaim = requireNonNull(userClaim);
+        this.roleClaim = requireNonNull(roleClaim);
     }
 
     /**
@@ -94,6 +112,8 @@ Allowed JWS signing algorithms (comma-separated, e.g. RS256, RS384, RS512, ES256
      */
     @Activate
     public BearerJwtRealmConfigImpl(final Configuration configuration) {
+        userClaim = configuration.user$_$claim();
+        roleClaim = configuration.role$_$claim();
         if (configuration.jwks$_$uri().isBlank()) {
             jwtProcessor = null;
             return;
@@ -144,7 +164,17 @@ private static DefaultJWTClaimsVerifier<SecurityContext> verifier(
     }
 
     @Override
-    public @Nullable JWTProcessor<SecurityContext> jwtProcessor() {
+    public JWTProcessor<SecurityContext> jwtProcessor() {
         return jwtProcessor;
     }
+
+    @Override
+    public String userClaim() {
+        return userClaim;
+    }
+
+    @Override
+    public String roleClaim() {
+        return roleClaim;
+    }
 }

aaa-shiro/impl/src/main/resources/org.opendaylight.aaa.shiro.bearerjwtrealm.cfg

@@ -13,3 +13,9 @@ expected-audience=""
 
 # Allowed JWS signing algorithms (comma-separated, e.g. RS256, RS384, RS512, ES256).
 allowed-algorithms=["RS256", "RS384", "RS512", "ES256"]
+
+# JWT claim name used to extract the username.
+user-claim="preferred_username"
+
+# JWT claim name used to extract the list of roles.
+role-claim="groups"

aaa-shiro/impl/src/test/java/org/opendaylight/aaa/shiro/realm/BearerJwtRealmTest.java

@@ -176,6 +176,26 @@ void testAuthorizationUnknownPrincipal() {
         assertNull(info.getRoles());
     }
 
+    /**
+     * Tests that custom user and role claim names are honored when configured.
+     */
+    @Test
+    void testCustomClaimNames() {
+        final var config = new BearerJwtRealmConfigImpl(null, "sub", "auth_roles");
+        try (var ignored = BearerJwtRealm.prepareForLoad(config)) {
+            final var customRealm = new BearerJwtRealm();
+            final var jwt = buildPlainJwt(new JWTClaimsSet.Builder()
+                .claim("sub", "custom-user")
+                .claim("auth_roles", List.of("admin", "viewer"))
+                .build());
+            final var info = customRealm.doGetAuthenticationInfo(new BearerToken(jwt));
+            assertNotNull(info);
+            final var principal = assertInstanceOf(ODLPrincipal.class, info.getPrincipals().getPrimaryPrincipal());
+            assertEquals("custom-user", principal.getUsername());
+            assertEquals(Set.of("admin", "viewer"), principal.getRoles());
+        }
+    }
+
     /**
      * Tests that a correctly signed JWT with valid claims passes verification.
      */
@@ -417,7 +437,7 @@ private static BearerJwtRealmConfigImpl buildConfig(final RSAKey rsaKey, final S
         final var processor = new DefaultJWTProcessor<>();
         processor.setJWSKeySelector(keySelector);
         processor.setJWTClaimsSetVerifier(claimsVerifier);
-        return new BearerJwtRealmConfigImpl(processor);
+        return new BearerJwtRealmConfigImpl(processor, USER_CLAIM, ROLE_CLAIM);
     }
 
     private static Date futureDate() {