Merge pull request #13361 from Akila94/resource-access-validation-pol…

…icy-templates

Add jwt claim based access validator policy templates

modules/distribution/resources/operation_policies/definitions/jwtClaimBasedAccessValidator_v1.j2

@@ -0,0 +1,6 @@
+<class name="org.wso2.carbon.apimgt.gateway.mediators.ClaimBasedResourceAccessValidationMediator">
+ <property name="accessVerificationClaim" value = "{{accessVerificationClaim}}"/>
+ <property name="accessVerificationClaimValue" value="{{accessVerificationClaimValue}}"/>
+ <property name="accessVerificationClaimValueRegex" value="{{accessVerificationClaimValueRegex}}"/>
+ <property name="shouldAllowValidation" value="{{shouldAllowValidation}}"/>
+</class>

modules/distribution/resources/operation_policies/specifications/jwtClaimBasedAccessValidator_v1.json

@@ -0,0 +1,51 @@
+{
+ "category": "Mediation",
+ "name": "jwtClaimBasedAccessValidator",
+ "version": "v1",
+ "displayName": "JWT claim based access validator",
+ "description": "This policy validates configured claim name and value in this policy with the claim name and value sent in the JWT access token to grant access to the API resource.",
+ "applicableFlows": [
+ "request"
+ ],
+ "supportedGateways": [
+ "Synapse"
+ ],
+ "supportedApiTypes": [
+ "HTTP"
+ ],
+ "policyAttributes": [
+ {
+ "name": "accessVerificationClaim",
+ "displayName": "Access verification claim name",
+ "description": "This should be the name the custom claim which is expected in the JWT access token.",
+ "validationRegex": "^[a-zA-Z_]+$",
+ "type": "String",
+ "defaultValue": "aut",
+ "required": true
+ },
+ {
+ "name": "accessVerificationClaimValue",
+ "displayName": "Access verification claim value",
+ "description": "This should be the value of a custom claim which is expected in the JWT access token.",
+ "type": "String",
+ "defaultValue": "APPLICATION",
+ "required": true
+ },
+ {
+ "name": "accessVerificationClaimValueRegex",
+ "displayName": "Access verification claim value regex",
+ "description": "If a regex is provided, the claim values will be matched using this regex. Otherwise they will be checked for equality.",
+ "type": "String",
+ "defaultValue": "",
+ "required": false
+ },
+ {
+ "name": "shouldAllowValidation",
+ "displayName": "Allow flow when claims are not matching",
+ "description": "Tick this to allow the flow when the claims are not matching. Keeping this un-ticked will allow the flow only when the claims are matched.",
+ "type": "Boolean",
+ "defaultValue": "false",
+ "required": false
+ }
+ ]
+ }