add claims policy selector

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

proxy/pkg/proxy/policy/selector.go

@@ -67,6 +67,10 @@ func LoadSelector(cfg *config.PolicySelector) (Selector, error) {
 			accounts.NewAccountsService("com.owncloud.accounts", grpc.NewClient())), nil
 	}
 
+	if cfg.Claims != nil {
+		return NewClaimsSelector(cfg.Claims), nil
+	}
+
 	return nil, ErrUnexpectedConfigError
 }
 
@@ -117,3 +121,18 @@ func NewMigrationSelector(cfg *config.MigrationSelectorConf, ss accounts.Account
 
 	}
 }
+
+// NewClaimsSelector selects the policy based on the "ocis.routing.policy" claim
+func NewClaimsSelector(cfg *config.ClaimsSelectorConf) Selector {
+	return func(ctx context.Context, r *http.Request) (s string, err error) {
+		if claims := oidc.FromContext(r.Context()); claims != nil {
+			if p, ok := claims[oidc.OcisRoutingPolicy].(string); ok && p != "" {
+				// TODO check we know the routing policy?
+				return p, nil
+			}
+			return cfg.DefaultPolicy, nil
+		}
+
+		return cfg.UnauthenticatedPolicy, nil
+	}
+}