lokulus/claimstransformation

An implementation of the ADFS claims transformation language for .NET

claimstransformation's Issues

[AB#7] Add support for EXISTS([]) should always return true, regardless of input claims.

The expression EXISTS([]) returns true if any claims are present, otherwise false.
This is a breaking change from the previous version of this library where EXISTS([]) always returns true.

In order to reduce risk from the upgrade we should have a compatibility flag which preserves the old behaviour.

Create release pipeline.

[AB#2] Copy claims selector throws error when criteria and input claims are both empty.

Given the "pass through" expression C1: [] => ISSUE(CLAIM = C1), if the input claims are empty an error is raised.

<>c__DisplayClass27_0.<BuildSelector>b__0() line 362
ExpressionVisitor.Visit(IssueExpression expression) line 286
ExpressionVisitor.Visit(RuleExpression expression) line 312
ClaimsTransformationEngine.Transform(RuleExpression expression, IClaimsTransformationContext context) line 56
ClaimsTransformationEngine.Transform(IEnumerable`1 rules, IClaimsTransformationContext context) line 49
ClaimsTransformationEngine.Transform(IEnumerable`1 rules, IEnumerable`1 claims) line 31
ClaimsTransformationEngine.Transform(String rule, IEnumerable`1 claims) line 25

An example test:

const string EXPRESSION = "C1: [] => ISSUE(CLAIM = C1);";
var positive = new List<Claim>();
var pass = this.Engine.Transform(EXPRESSION, positive);
Assert.AreEqual(0, pass.Count(), "At least one claim was issued.");

[AB#6] This is a test.

[AB#3] EXISTS([]) is "false" when given an empty set of input claims.

It is common to always grant some kind of "anonymous" claim regardless of the input claims.
For example:
C1: NOT EXISTS([]) => ISSUE(TYPE = "http://namespace/role", VALUE = "Public")

When no input claims are provided, the role=public is not issued.

I'm not actually sure if this is actually an error.

[AB#5] Add Sonatype Lift vulnerabilities scan.

[AB#1] Set up the build pipeline.

Set up a .NET action which builds and tests the project.

[AB#4] Add Snyk vulnerabilities scan.