Identity as a Service:Use federated credential expressions

1. Client (client model)

In an IDaaS expression, access the properties of the Client model in the client.<fieldname> format. The following table lists the fields that the Client model supports:

2. PKCS#7 Federated Credential (PKCS#7 federated credential model)

In the IDaaS PKCS#7 federated credential model, access the following fields in the pkcs7.<fieldname> format. This model applies to the trust condition expressions of PKCS#7 federated trust sources and the validation condition expressions of PKCS#7 federated credentials.

3. PCA Federated Credential (PCA federated credential model)

In the IDaaS PCA federated credential model, access the following fields through the cert object. For example, to obtain the CN (Common Name) field of the certificate issuer, use the expression cert.issuer.subject.CN. This model applies to the trust condition expressions of PCA federated trust sources and the validation condition expressions of PCA federated credentials.

4. OIDC Federated Credential (OIDC federated credential model)

In the IDaaS OIDC federated credential model, access the following fields in the jwt.<fieldname> format. This model applies to the trust condition expressions of OIDC federated trust sources and the validation condition expressions of OIDC federated credentials. The following table lists the main fields of the OIDC federated credential model:

{
  "aud": [
    "https://example.com",
    "https://example2.com"
  ]
}

5. CertificateObject model

The CertificateObject model is used for certificate-related validation scenarios and provides access to each certificate field. Access the following fields in the cert.<fieldname> format. This model applies to scenarios such as certificate chain validation, certificate property validation, and certificate validity period checks.

The fields of the CertificateSubjectObject model are as follows:

Expression examples

To use any of the preceding models in an expression, retrieve values in accordance with JSON semantics. If a JSON key contains special characters such as ".", "-", or "_", enclose the key in single quotation marks.

Trust conditions for federated trust sources

1. PCA

   // Get the CN field of the issuer of the certificate uploaded to PCA and compare it
   // For example, the certificate issuer is: C=cn, ST=sichuan, L=chengdu, O=example, OU=test, CN=test
   Equals(cert.issuer.CN, "test")
   
   // Check whether the certificate is a certification authority (that is, it can issue other certificates)
   Equals(cert.ca, true)
   

2. OIDC

   // Check whether the subject in the serviceaccount OIDC token of the Kubernetes cluster is correct
   Equals(jwt.sub, "test")
   
   // Check both the issuer and the audience
   And(Equals(jwt.iss, "https://example.com"), Equals(jwt.aud, "test_aud"))

3. PKCS#7

   If you select a PKCS#7 federated trust source, you do not need to enter a trust condition expression.

Validation conditions for federated credentials

Write the validation condition expression of a federated credential in the same way as the trust condition of a federated trust source: both retrieve the corresponding fields from the data model for validation. IDaaS provides quick configuration modes that automatically generate basic validation expressions and simplify configuration.

1. PCA

   // When the validation condition mode is Certificate Mode and the common name (CN) entered is example, the generated expression is:
   Equals(cert.subject.CN, "example")
   
   // To use a custom expression to validate other conditions, select Client Certificate Field Expression Validation Mode
   // For example, to validate the following fields in the client certificate issuer: country, location, and province
   // For example, the certificate issuer is: C=cn, ST=sichuan, L=chengdu, O=example, OU=test, CN=test
   And(Equals(cert.issuer.C, "cn"), Equals(cert.issuer.L, "chengdu"), Equals(cert.issuer.ST, "sichuan"))
   
   // Validate the serial number of the certificate. Note: the serial number is in hexadecimal format, all lowercase, without colons. You can use functions to convert it
   // For example, the serial number shown in the certificate is 6d:5a:28:16:af:46:7f:40:d3:8b:e7:28:0f:6e:97:4f:11:4a:06:1e. Use the StringReplace() function to remove the colons. The expression is:
   // StringReplace("original string","characters to be replaced","replacement characters")
   Equals(cert.serialNumber, StringReplace("6d:5a:28:16:af:46:7f:40:d3:8b:e7:28:0f:6e:97:4f:11:4a:06:1e",":",""))
   
   // If the serial number is all uppercase, such as 6D:5A:28:16:AF:46:7F:40:D3:8B:E7:28:0F:6E:97:4F:11:4A:06:1E
   // Use the ToLower() function to convert the string to lowercase, and then use the StringReplace() function to remove the colons
   Equals(cert.serialNumber, StringReplace(ToLower("6D:5A:28:16:AF:46:7F:40:D3:8B:E7:28:0F:6E:97:4F:11:4A:06:1E"),":",""))

2. OIDC

   // When Kubernetes Mode is used, the namespace entered is test and the service account entered is test
   // The automatically generated expression is:
   And(Equals(jwt.claims.'kubernetes.io'.namespace, "test"), Equals(jwt.claims.'kubernetes.io'.serviceaccount.name, "test"), Equals(jwt.sub, "system:serviceaccount:test:test"))
   
   // When Subject Identity Mode is used, the subject identity entered is https://sub.example.com
   // The automatically generated expression is:
   Equals(jwt.sub, "https://sub.example.com")
   
   // To use a custom expression to validate other conditions, select Claims Field Expression Validation Mode
   // To validate the jti field of the current OIDC token, the expression is:
   Equals(jwt.jti, "test_XXX")
   
   // If the user defines a custom field named customValue in the claims of the OIDC token and wants to validate that field, the expression is:
   Equals(jwt.claims.customValue, "XXX")
   
   // To compare whether aud is correct: aud is in array format, so you must obtain the corresponding aud value by array index for comparison.
   // (Recommended) Validate aud through the aud field of the OIDC federated trust source instead of in the validation conditions of the federated credential.
   // When aud has only one value, the expression is:
   Equals(jwt.aud[0], "example_aud")
   // When aud has multiple values, you can use the Or() function for comparison, which passes the validation if any one aud matches. The expression is:
   Or(Equals(jwt.aud[0], "https://example.com"), Equals(jwt.aud[1], "https://example2.com"))

3. PKCS#7

   // If the current federated trust source is Alibaba Cloud PKCS#7, the selected validation condition mode is Specify Cloud Server Instance Mode, and the cloud server instance IDs entered are i-123 and i-456, the generated expression is:
   Or(Equals(pkcs7.payload.jsonData.'instance-id', "i-123"),Equals(pkcs7.payload.jsonData.'instance-id', "i-456"))
   
   // If the federated trust source is AWS PKCS#7, the selected validation condition mode is Specify Cloud Server Instance Mode, and the cloud server instance IDs entered are i-123 and i-456, the generated expression is:
   Or(Equals(pkcs7.payload.jsonData.instanceId, "i-123"),Equals(pkcs7.payload.jsonData.instanceId, "i-456"))
   
   // To use a custom expression to validate other conditions, select Signature Value Expression Validation Mode
   // For example, to validate the region-id field in the Alibaba Cloud PKCS#7 signature value, the expression is:
   Equals(pkcs7.payload.jsonData.'region-id', "cn-hangzhou")

Available fields for Alibaba Cloud PKCS#7

Available fields for AWS PKCS#7