Multiple Require AND clauses, and jq

[rooprob]

Hi,
Thanks for providing this module.

My question is about supporting complex rules involving the requirement that multiple Require statements need be satisfied.

For example suppose the hypothetical need to have an ACL with both aud and scope, where scope is a space-separated list of terms. I've wrapped the terms with regex word boundary \b markers, but appreciate the native support for tokenizing terms offering stronger equality matching.

example only,

  Require claim aud:server_a  && (claim scope#scope_x || claim scope#scope_y) 

where # is a made up syntax for meaning "in the list of"

I understand RewriteCond has an implicit AND and supports [OR] as a flag. Here's our equivalent

  AuthType oauth20
  Require claim aud:server_a
 
  # ALLOW ONLY method + scope.
  # GET AND scope_x OR scope_y
  RewriteCond %{REQUEST_METHOD} GET [NC]
  RewriteCond "%{ENV:OIDC_CLAIM_scope}" \bscope_x\b [NC,OR]
  RewriteCond "%{ENV:OIDC_CLAIM_scope}" \bscope_y\b [NC]              
  RewriteRule (.*) - [L]

  # Deny access
  RewriteRule ^ - [F,L]

The jq support offers most possibilities, the index syntax offering robust equality checking,

  Require claims_expr '.aud == "server_a" and (.scope | index("scope_x") != null) or (.scope | index("scope_y") != null)'

I'm not sure how nice a very long clause could be split over multiple lines for readability, where (arguably) having more control over how multiple Require statements would be beneficial. Haven't tried jq as our policy permits taking compiled packages, but not building from source. Hence the following question:

Could the jq support be added to the binary release by default?

Questions for the roadmap,

• Could Require support "AND"?
• Options for supporting matching on strings within space-separated claims like scope

[zandbelt]

you can use <RequireAll> https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#requireall for AND semantics and regular based expressions for loose matching, see https://github.com/zmartzone/mod_auth_openidc/wiki/Authorization#1-mod_auth_openidc (last paragraph)