add claims policy selector

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

proxy/pkg/config/config.go

@@ -141,6 +141,7 @@ type OIDC struct {
 type PolicySelector struct {
 	Static    *StaticSelectorConf
 	Migration *MigrationSelectorConf
+	Claims    *ClaimsSelectorConf
 }
 
 // StaticSelectorConf is the config for the static-policy-selector
@@ -166,6 +167,12 @@ type MigrationSelectorConf struct {
 	UnauthenticatedPolicy string `mapstructure:"unauthenticated_policy"`
 }
 
+// ClaimsSelectorConf is the config for the claims-selector
+type ClaimsSelectorConf struct {
+	DefaultPolicy         string `mapstructure:"default_policy"`
+	UnauthenticatedPolicy string `mapstructure:"unauthenticated_policy"`
+}
+
 // New initializes a new configuration
 func New() *Config {
 	return &Config{

proxy/pkg/middleware/account_resolver.go

@@ -83,6 +83,8 @@ func (m accountResolver) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 			}
 			m.logger.Debug().Interface("claims", claims).Msg("Autoprovisioning user")
 			u, err = m.userProvider.CreateUserFromClaims(req.Context(), claims)
+			// TODO instead of creating an account create a personal storage via the CS3 admin api?
+			// see https://cs3org.github.io/cs3apis/#cs3.admin.user.v1beta1.CreateUserRequest
 		}
 
 		if errors.Is(err, backend.ErrAccountDisabled) {

proxy/pkg/proxy/policy/selector.go

@@ -67,6 +67,10 @@ func LoadSelector(cfg *config.PolicySelector) (Selector, error) {
 			accounts.NewAccountsService("com.owncloud.accounts", grpc.NewClient())), nil
 	}
 
+	if cfg.Claims != nil {
+		return NewClaimsSelector(cfg.Claims), nil
+	}
+
 	return nil, ErrUnexpectedConfigError
 }
 
@@ -117,3 +121,18 @@ func NewMigrationSelector(cfg *config.MigrationSelectorConf, ss accounts.Account
 
 	}
 }
+
+// NewClaimsSelector selects the policy based on the "ocis.routing.policy" claim
+func NewClaimsSelector(cfg *config.ClaimsSelectorConf) Selector {
+	return func(ctx context.Context, r *http.Request) (s string, err error) {
+		if claims := oidc.FromContext(r.Context()); claims != nil {
+			if p, ok := claims[oidc.OcisRoutingPolicy].(string); ok && p != "" {
+				// TODO check we know the routing policy?
+				return p, nil
+			}
+			return cfg.DefaultPolicy, nil
+		}
+
+		return cfg.UnauthenticatedPolicy, nil
+	}
+}