@@ -23,6 +23,8 @@ import (
2323 "github.com/rs/zerolog/log"
2424)
2525
26+ const alternativeUserIDClaim = "user_id"
27+
2628type VerifierConfig struct {
2729 // HMACSecretKey is a secret key used to validate connection and subscription
2830 // tokens generated using HMAC. Zero value means that HMAC tokens won't be allowed.
@@ -56,6 +58,11 @@ type VerifierConfig struct {
5658 // IssuerRegex allows setting Issuer in form of Go language regex pattern. Regex groups
5759 // may be then used in constructing JWKSPublicEndpoint.
5860 IssuerRegex string
61+
62+ // UserIDClaim allows overriding default claim used to extract user ID from token. At this
63+ // moment only "user_id" alternative claim is supported due to how tokens are parsed.
64+ // By default, Centrifugo uses "sub".
65+ UserIDClaim string
5966}
6067
6168func (c VerifierConfig ) Validate () error {
@@ -94,6 +101,7 @@ func NewTokenVerifierJWT(config VerifierConfig, ruleContainer *rule.Container) (
94101 issuerRe : issuerRe ,
95102 audience : config .Audience ,
96103 audienceRe : audienceRe ,
104+ userIDClaim : config .UserIDClaim ,
97105 }
98106
99107 algorithms , err := newAlgorithms (config .HMACSecretKey , config .RSAPublicKey , config .ECDSAPublicKey )
@@ -122,6 +130,7 @@ type VerifierJWT struct {
122130 audienceRe * regexp.Regexp
123131 issuer string
124132 issuerRe * regexp.Regexp
133+ userIDClaim string
125134}
126135
127136var (
@@ -180,6 +189,8 @@ type ConnectTokenClaims struct {
180189 Channels []string `json:"channels,omitempty"`
181190 Subs map [string ]SubscribeOptions `json:"subs,omitempty"`
182191 Meta json.RawMessage `json:"meta,omitempty"`
192+ // UserID is only used instead of jwt.RegisteredClaims.Subject when explicitly configured.
193+ UserID string `json:"user_id,omitempty"`
183194 // Channel must never be set in connection tokens. We check this on verifying.
184195 Channel string `json:"channel,omitempty"`
185196 jwt.RegisteredClaims
@@ -191,6 +202,8 @@ type SubscribeTokenClaims struct {
191202 Channel string `json:"channel,omitempty"`
192203 Client string `json:"client,omitempty"`
193204 ExpireAt * int64 `json:"expire_at,omitempty"`
205+ // UserID is only used instead of jwt.RegisteredClaims.Subject when explicitly configured.
206+ UserID string `json:"user_id,omitempty"`
194207}
195208
196209type jwksManager struct { * jwks.Manager }
@@ -579,13 +592,16 @@ func (verifier *VerifierJWT) VerifyConnectToken(t string, skipVerify bool) (Conn
579592 }
580593
581594 ct := ConnectToken {
582- UserID : claims .RegisteredClaims .Subject ,
583595 Info : info ,
584596 Subs : subs ,
585597 ExpireAt : expireAt ,
586598 Meta : claims .Meta ,
587599 }
588-
600+ if verifier .userIDClaim != "" {
601+ ct .UserID = claims .UserID
602+ } else {
603+ ct .UserID = claims .RegisteredClaims .Subject
604+ }
589605 return ct , nil
590606}
591607
@@ -736,6 +752,11 @@ func (verifier *VerifierJWT) VerifySubscribeToken(t string, skipVerify bool) (Su
736752 Data : data ,
737753 },
738754 }
755+ if verifier .userIDClaim != "" {
756+ st .UserID = claims .UserID
757+ } else {
758+ st .UserID = claims .RegisteredClaims .Subject
759+ }
739760 return st , nil
740761}
741762
@@ -766,11 +787,11 @@ func (verifier *VerifierJWT) Reload(config VerifierConfig) error {
766787 return fmt .Errorf ("error compiling issuer regex: %w" , err )
767788 }
768789 }
769-
770790 verifier .algorithms = alg
771791 verifier .audience = config .Audience
772792 verifier .audienceRe = audienceRe
773793 verifier .issuer = config .Issuer
774794 verifier .issuerRe = issuerRe
795+ verifier .userIDClaim = config .UserIDClaim
775796 return nil
776797}
0 commit comments