feat: As a user, I want to openid-connect support post check, so that I can do authz based on token

[wenerme]

Description

As a user, I want to openid-connect support post check, so that I can do authz based on token.

• authz-keycloak is complicated, don't support some features (e.g. check groups).
• openid-connect is easy to setup

I hope I can post check the token to do authz, e.g.

post_check: |
  return local function(access_token,id_token,userinfo,conf,ctx)
   // check access_token.groups contains something
   return 401, '{}'
  end

[wenerme]

xref #8772

[Revolyssup]

@wenerme Similar to #8772, You want to further restrict access by matching claims right?

[Revolyssup]

@lingsamuel Assign this to me

[wenerme]

@Revolyssup yes, but I try to using opa now, opa can work with oidc, can share with other context. If apisix don't want to handle the random script, can tell other user to use opa too. I searched the issues, there are few related to this post check, by allowing passing script is the only way to match all these requests.

[Revolyssup]

@Revolyssup yes, but I try to using opa now, opa can work with oidc, can share with other context. If apisix don't want to handle the random script, can tell other user to use opa too. I searched the issues, there are few related to this post check, by allowing passing script is the only way to match all these requests.

If OPA solved your use case, we can close this issue and continue tracking #8772

[Revolyssup]

@wenerme Any updates here?

[wenerme]

@Revolyssup ok to close this.