Make the name of the claim for roles configurable

Author: WilliamBZA

src/ServiceControl.Audit/Infrastructure/Hosting/Commands/RunCommand.cs

@@ -19,7 +19,7 @@ public override async Task Execute(HostArguments args, Settings settings)
             var hostBuilder = WebApplication.CreateBuilder();
 
             hostBuilder.AddServiceControlAuthentication(settings.OpenIdConnectSettings);
-            hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings.Enabled);
+            hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings);
             hostBuilder.AddServiceControlHttps(settings.HttpsSettings);
             hostBuilder.AddServiceControlAudit((_, __) =>
             {

src/ServiceControl.Hosting/Auth/HostApplicationBuilderExtensions.cs

@@ -36,7 +36,8 @@ public static void AddServiceControlAuthentication(this IHostApplicationBuilder
                     ValidateLifetime = oidcSettings.ValidateLifetime,
                     ValidateIssuerSigningKey = oidcSettings.ValidateIssuerSigningKey,
                     ValidAudience = oidcSettings.Audience,
-                    ClockSkew = TimeSpan.FromMinutes(5) // Allow 5 minutes clock skew
+                    ClockSkew = TimeSpan.FromMinutes(5), // Allow 5 minutes clock skew
+                    RoleClaimType = oidcSettings.RolesClaimName
                 };
                 options.RequireHttpsMetadata = oidcSettings.RequireHttpsMetadata;
                 // Don't map inbound claims to legacy Microsoft claim types

src/ServiceControl.Hosting/Auth/PermissionAuthorizationExtensions.cs

@@ -5,6 +5,7 @@ namespace ServiceControl.Hosting.Auth;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Options;
+using ServiceControl.Infrastructure;
 
 /// <summary>
 /// Registers the permission-based policy authorization services: a dynamic
@@ -20,8 +21,13 @@ namespace ServiceControl.Hosting.Auth;
 /// </summary>
 public static class PermissionAuthorizationExtensions
 {
-    public static void AddServiceControlAuthorization(this IHostApplicationBuilder hostBuilder, bool oidcEnabled)
+    public static void AddServiceControlAuthorization(this IHostApplicationBuilder hostBuilder, OpenIdConnectSettings oidcSettings)
     {
+        if (!oidcSettings.RoleBasedAuthorizationEnabled)
+        {
+            return;
+        }
+
         var services = hostBuilder.Services;
 
         // Ensure the authorization core services and options are present (idempotent).
@@ -31,13 +37,8 @@ public static void AddServiceControlAuthorization(this IHostApplicationBuilder h
         // policy provider registered by AddAuthorization(). When OIDC is disabled it returns allow-all
         // policies (no requirement); when enabled it emits a PermissionRequirement for the verb handler.
         services.AddSingleton<IAuthorizationPolicyProvider>(sp =>
-            new PermissionPolicyProvider(sp.GetRequiredService<IOptions<AuthorizationOptions>>(), oidcEnabled));
+            new PermissionPolicyProvider(sp.GetRequiredService<IOptions<AuthorizationOptions>>(), oidcSettings.Enabled));
 
-        // The role-based handler is only needed when OIDC is enabled — otherwise the provider produces
-        // no PermissionRequirement for it to evaluate.
-        if (oidcEnabled)
-        {
-            services.AddSingleton<IAuthorizationHandler, PermissionVerbHandler>();
-        }
+        services.AddSingleton<IAuthorizationHandler>(service => new PermissionVerbHandler(oidcSettings.RolesClaimName));
     }
 }

src/ServiceControl.Hosting/Auth/PermissionPolicyProvider.cs

@@ -45,7 +45,7 @@ static FrozenDictionary<string, AuthorizationPolicy> BuildPolicies(bool oidcEnab
             StringComparer.Ordinal);
 
     public Task<AuthorizationPolicy?> GetPolicyAsync(string policyName) =>
-        Task.FromResult<AuthorizationPolicy?>(policies.GetValueOrDefault(policyName));
+        Task.FromResult(policies.GetValueOrDefault(policyName));
 
     public Task<AuthorizationPolicy> GetDefaultPolicyAsync()
     {

src/ServiceControl.Hosting/Auth/PermissionVerbHandler.cs

@@ -18,20 +18,17 @@ namespace ServiceControl.Hosting.Auth;
 /// </summary>
 public sealed class PermissionVerbHandler : AuthorizationHandler<PermissionRequirement>
 {
-    // TODO: The claim that carries a user's roles is identity-provider specific and must become
-    // configurable (per-IdP) rather than hardcoded. Roles are expected as a flat, multivalued claim;
-    // the token handler splits a top-level JSON array into individual claims, so no parsing is needed.
-    // For Keycloak, add a "User Realm Role" protocol mapper with Multivalued = ON and Token Claim Name
-    // = "roles" (a dotted name like "realm_access.roles" would nest it into an object instead).
-    const string RoleClaimType = "roles";
+    public PermissionVerbHandler(string rolesClaimName)
+    {
+        RoleClaimType = rolesClaimName;
+    }
 
     protected override Task HandleRequirementAsync(
         AuthorizationHandlerContext context,
         PermissionRequirement requirement)
     {
         var roles = context.User.FindAll(RoleClaimType).Select(claim => claim.Value);
 
-
         // TODO: Although plural, likely roles will only contain a single value unless we want to define a role for each instance but likely customers don't care about instances
         if (RolePermissions.IsGranted(roles, requirement.Permission))
         {
@@ -41,4 +38,6 @@ protected override Task HandleRequirementAsync(
         // Otherwise leave the requirement unmet → the request is denied (403/401).
         return Task.CompletedTask;
     }
+
+    internal string RoleClaimType = "roles";
 }

src/ServiceControl.Infrastructure/Auth/RolePermissions.cs

@@ -7,7 +7,7 @@ namespace ServiceControl.Infrastructure.Auth;
 using System.Linq;
 
 /// <summary>
-/// Hardcoded role → permission policy. Two roles for now:
+/// Role → permission policy. Two roles:
 /// <list type="bullet">
 ///   <item><c>reader</c> — granted every <c>*:*:view</c> permission (read-only access).</item>
 ///   <item><c>writer</c> — granted every permission (<c>*:*:*</c>).</item>
@@ -17,10 +17,6 @@ namespace ServiceControl.Infrastructure.Auth;
 /// immutable <see cref="FrozenSet{T}"/> of granted permissions per role. As a result both
 /// <see cref="IsGranted"/> and <see cref="GetPermissions(string)"/> are O(1) hash lookups with no
 /// per-call pattern matching or allocation.
-/// <para>
-/// TODO: interim hardcoded model — replace with a configurable role/permission mapping (loaded from
-/// configuration or the IdP) when more than these two coarse roles are needed.
-/// </para>
 /// </summary>
 public static class RolePermissions
 {

src/ServiceControl.Infrastructure/OpenIdConnectSettings.cs

@@ -32,6 +32,9 @@ public OpenIdConnectSettings(SettingsRootNamespace rootNamespace, bool validateC
         ValidateIssuerSigningKey = SettingsReader.Read(rootNamespace, "Authentication.ValidateIssuerSigningKey", true);
         RequireHttpsMetadata = SettingsReader.Read(rootNamespace, "Authentication.RequireHttpsMetadata", true);
 
+        RolesClaimName = SettingsReader.Read(rootNamespace, "Authentication.RolesClaimName", "roles");
+        RoleBasedAuthorizationEnabled = SettingsReader.Read(rootNamespace, "Authentication.RoleBasedAuthorizationEnabled", false);
+
         // ServicePulse settings are only relevant for the primary ServiceControl instance
         // which serves the OIDC configuration endpoint that ServicePulse uses for login
         if (requireServicePulseSettings)
@@ -114,6 +117,18 @@ public OpenIdConnectSettings(SettingsRootNamespace rootNamespace, bool validateC
     /// </summary>
     public string ServicePulseApiScopes { get; }
 
+    /// <summary>
+    /// The name of the claim that is presented by the IdP that contains the roles that the user is
+    /// part of. The claim is expected to be a multiple value claim.
+    /// </summary>
+    public string RolesClaimName { get; }
+
+    /// <summary>
+    /// Is RBAC enabled. When false, all authenticated users have access to all methods. When true,
+    /// role based authorization rules are applied.
+    /// </summary>
+    public bool RoleBasedAuthorizationEnabled { get; }
+
     void Validate(bool requireServicePulseSettings)
     {
         if (Enabled)

src/ServiceControl.Monitoring/Hosting/Commands/RunCommand.cs

@@ -16,7 +16,7 @@ public override async Task Execute(HostArguments args, Settings settings)
 
             var hostBuilder = WebApplication.CreateBuilder();
             hostBuilder.AddServiceControlAuthentication(settings.OpenIdConnectSettings);
-            hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings.Enabled);
+            hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings);
             hostBuilder.AddServiceControlHttps(settings.HttpsSettings);
             hostBuilder.AddServiceControlMonitoring((_, __) => Task.CompletedTask, settings, endpointConfiguration);
             hostBuilder.AddServiceControlMonitoringApi();

src/ServiceControl/Hosting/Commands/RunCommand.cs

@@ -25,7 +25,7 @@ public override async Task Execute(HostArguments args, Settings settings)
             var hostBuilder = WebApplication.CreateBuilder();
 
             hostBuilder.AddServiceControlAuthentication(settings.OpenIdConnectSettings);
-            hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings.Enabled);
+            hostBuilder.AddServiceControlAuthorization(settings.OpenIdConnectSettings);
             hostBuilder.AddServiceControlHttps(settings.HttpsSettings);
             hostBuilder.AddServiceControl(settings, endpointConfiguration);
             hostBuilder.AddServiceControlApi(settings.CorsSettings);