Identity as a Service:Use federated credential expressions

1. Client (client model)

In IDaaS expressions, you can access the properties of the Client data model using the client.fieldname format. The following table lists the fields that the Client data model supports and their descriptions:

2. PKCS#7 Federated Credential (PKCS#7 federated credential model)

In the IDaaS PKCS#7 federated credential model, you can access the following fields using the pkcs7.fieldname format. This data model applies to conditional expressions for the trust of PKCS#7 federated trust sources and the validation of PKCS#7 federated credentials.

3. PCA Federated Credential (PCA federated credential model)

In the IDaaS PCA federated credential model, you can access the following fields through the cert object. For example, to retrieve the Common Name (CN) field of the certificate issuer, you can use the expression `cert.issuer.subject.CN`. This data model applies to conditional expressions for the trust of PCA federated trust sources and the validation of PCA federated credentials.

4. OIDC Federated Credential (OIDC federated credential model)

In the IDaaS OIDC federated credential model, you can access the following fields using the jwt.fieldname format. This data model applies to conditional expressions for the trust of OIDC federated trust sources and the validation of OIDC federated credentials. The following table lists the main fields of the OIDC federated credential model and their descriptions:

{
  "aud": [
    "https://example.com",
    "https://example2.com"
  ]
}

5. CertificateObject model

The CertificateObject model handles certificate-related validation scenarios and provides access to various fields of a certificate. You can access the following fields using the cert.fieldname format. This data model applies to scenarios such as certificate chain validation, certificate property validation, and certificate validity period checks.

The fields of the CertificateSubjectObject model are as follows:

Expression examples

To use any of the preceding data models in an expression, you must retrieve values based on JSON semantics. If a JSON key contains special characters, such as a period (.), hyphen (-), or underscore (_), you must enclose the key in single quotation marks.

Trust conditions for federated trust sources

1. PCA

   // Obtain the CN field of the issuer from the uploaded PCA certificate for comparison.
   // For example, the certificate issuer is C=cn, ST=sichuan, L=chengdu, O=example, OU=test, CN=test.
   Equals(cert.issuer.CN, "test")
   
   // Determine whether the certificate is a CA certificate that can be used to issue other certificates.
   Equals(cert.ca, true)
   

2. OIDC

   // Determine whether the subject in the service account OIDC token of the Kubernetes cluster is correct.
   Equals(jwt.sub, "test")
   
   // Determine whether the issuer and audience are correct at the same time.
   And(Equals(jwt.iss, "https://example.com"), Equals(jwt.aud, "test_aud"))

3. PKCS#7

   If you select a PKCS#7 federated trust source, you do not need to enter a conditional expression for trust.

Validation conditions for federated credentials

The method for writing conditional expressions for federated credential validation is similar to writing them for federated trust source trust. You can retrieve the corresponding fields from the data model for validation. IDaaS provides a quick configuration mode that automatically generates basic validation expressions to simplify the configuration process.

1. PCA

   // When the validation condition mode is Certificate Mode and the common name (CN) is example, the generated expression is as follows:
   Equals(cert.subject.CN, "example")
   
   // To customize an expression to validate other conditions, select Client Certificate Field Expression Validation Mode.
   // For example, you want to validate the country, location, and province in the issuer of the client certificate.
   // For example, the certificate issuer is C=cn, ST=sichuan, L=chengdu, O=example, OU=test, CN=test.
   And(Equals(cert.issuer.C, "cn"), Equals(cert.issuer.L, "chengdu"), Equals(cert.issuer.ST, "sichuan"))
   
   // Determine the serial number of the certificate. Note: The serial number is in hexadecimal format, is in lowercase, and does not contain colons. You can use a function for conversion.
   // For example, the serial number in the certificate is 6d:5a:28:16:af:46:7f:40:d3:8b:e7:28:0f:6e:97:4f:11:4a:06:1e. Use the StringReplace() function to remove the colons. The expression is as follows:
   // StringReplace("original_string","character_to_be_replaced","replacement_character")
   Equals(cert.serialNumber, StringReplace("6d:5a:28:16:af:46:7f:40:d3:8b:e7:28:0f:6e:97:4f:11:4a:06:1e",":",""))
   
   // If the serial number is in uppercase, such as 6D:5A:28:16:AF:46:7F:40:D3:8B:E7:28:0F:6E:97:4F:11:4A:06:1E
   // Use the ToLower() function to convert the string to lowercase, and then use the StringReplace() function to remove the colons.
   Equals(cert.serialNumber, StringReplace(ToLower("6D:5A:28:16:AF:46:7F:40:D3:8B:E7:28:0F:6E:97:4F:11:4A:06:1E"),":",""))

2. OIDC

   // When Kubernetes Mode is used, the namespace is test and the service account is test.
   // The automatically generated expression is as follows:
   And(Equals(jwt.claims.'kubernetes.io'.namespace, "test"), Equals(jwt.claims.'kubernetes.io'.serviceaccount.name, "test"), Equals(jwt.sub, "system:serviceaccount:test:test"))
   
   // When Subject Identity Mode is used, the subject identity is https://sub.example.com.
   // The automatically generated expression is as follows:
   Equals(jwt.sub, "https://sub.example.com")
   
   // To customize an expression to validate other conditions, select Claims Field Expression Validation Mode.
   // For example, to validate the jti field of the current OIDC token, the expression is as follows:
   Equals(jwt.jti, "test_XXX")
   
   // If a user defines a custom field named customValue in the claims of an OIDC token and wants to validate this field, the expression is as follows:
   Equals(jwt.claims.customValue, "XXX")
   
   // To determine whether the aud is correct, you need to retrieve the corresponding aud value using the array index for comparison because aud is in an array format.
   // We recommend that you validate the aud field of the OIDC federated trust source instead of validating it in the validation conditions for the federated credential.
   // When aud has only one value, the expression is as follows:
   Equals(jwt.aud[0], "example_aud")
   // When aud has multiple values, you can use the Or() function for comparison. This indicates that the validation is passed if at least one aud value matches. The expression is as follows:
   Or(Equals(jwt.aud[0], "https://example.com"), Equals(jwt.aud[1], "https://example2.com"))

3. PKCS#7

   // If the current federated trust source is Alibaba Cloud PKCS#7, the validation condition mode is Specify ECS Instance Mode, and the ECS instance IDs are i-123 and i-456, the generated expression is as follows:
   Or(Equals(pkcs7.payload.jsonData.'instance-id', "i-123"),Equals(pkcs7.payload.jsonData.'instance-id', "i-456"))
   
   // If the federated trust source is AWS PKCS#7, the validation condition mode is Specify ECS Instance Mode, and the ECS instance IDs are i-123 and i-456, the generated expression is as follows:
   Or(Equals(pkcs7.payload.jsonData.instanceId, "i-123"),Equals(pkcs7.payload.jsonData.instanceId, "i-456"))
   
   // To customize an expression to validate other conditions, select Signature Value Expression Validation Mode.
   // For example, to validate the region-id field in the signature value of Alibaba Cloud PKCS#7, the expression is as follows:
   Equals(pkcs7.payload.jsonData.'region-id', "cn-hangzhou")

Available fields for Alibaba Cloud PKCS#7

Amazon Web Services PKCS7 available fields