From db09d546e0659fd339b64a3b07424c4589f215a1 Mon Sep 17 00:00:00 2001 From: Admin Bot Date: Mon, 14 Sep 2026 08:18:15 +0900 Subject: [PATCH] fix: check scope claim for client_credentials JWT auth Authentik client_credentials tokens don't carry roles/permissions claims (scope mappings not evaluated). Capabilities are carried as space-separated scope values instead. Gateway now checks scope claim as fallback after roles and permissions. --- internal/auth/jwt.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go index 8838103..c30757d 100644 --- a/internal/auth/jwt.go +++ b/internal/auth/jwt.go @@ -165,6 +165,20 @@ func (v *Validator) CheckPermissions(claims jwt.MapClaims, required ...string) b } } + // Fall back to scope claim (for client_credentials tokens) + // Authentik client_credentials tokens carry capabilities as space-separated scopes + if scopeIface, ok := claims["scope"]; ok { + if scopeStr, ok := scopeIface.(string); ok { + for _, s := range strings.Split(scopeStr, " ") { + for _, req := range required { + if s == req { + return true + } + } + } + } + } + return false }