Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support for Azure AD appRoles Claims in OIDC Authentication #4934

Open
amitej25 opened this issue Jan 19, 2025 · 0 comments
Open

Add Support for Azure AD appRoles Claims in OIDC Authentication #4934

amitej25 opened this issue Jan 19, 2025 · 0 comments
Labels
kind/feature New feature or request

Comments

@amitej25
Copy link

Is your feature request related to a problem? Please describe.
Feast currently supports OIDC-based authentication and expects the resource_access claim in the access token to manage roles and permissions. However, Azure AD issues tokens with appRoles instead of resource_access, causing a mismatch between the token structure and Feast's expectations.

This leads to challenges when integrating Feast with Azure AD for authentication, as Feast cannot interpret the appRoles claim.

Describe the solution you'd like
Enhance Feast's OIDC implementation to support multiple token formats by:

Checking for the appRoles claim when resource_access is not found.

Additional context
Observed Behavior:
When using Azure AD for OIDC-based authentication, the access token contains the following structure:

{
  "appRoles": [
    {
      "allowedMemberTypes": ["User", "Application"],
      "displayName": "feast.reader",
      "value": "feast.reader"
    },
    {
      "allowedMemberTypes": ["User", "Application"],
      "displayName": "feast.writer",
      "value": "feast.writer"
    }
  ]
},

Feast, however, expects the token to contain the resource_access claim:

{
  "resource_access": {
    "app": {
      "roles": ["reader", "writer"]
    }
  }
}

This results in Feast failing to validate roles and permissions from the Azure AD token.

@amitej25 amitej25 added the kind/feature New feature or request label Jan 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant