feat: added allow_if authorizer

[akselleirv]

Related issue(s)

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  security@ory.sh) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.

Will update these as soon I'm close to an approval.

• I have added or changed the documentation.

Further Comments

[CLAassistant]

All committers have signed the CLA.

[codecov]

Codecov Report

Merging #1034 (fc8bf74) into master (f363b3a) will increase coverage by 0.03%.
The diff coverage is 81.81%.

@@            Coverage Diff             @@
##           master    #1034      +/-   ##
==========================================
+ Coverage   78.70%   78.73%   +0.03%     
==========================================
  Files          83       84       +1     
  Lines        3869     3913      +44     
==========================================
+ Hits         3045     3081      +36     
- Misses        554      559       +5     
- Partials      270      273       +3     

Impacted Files	Coverage Δ
pipeline/authz/authorizer_allow_if.go	81.81% <81.81%> (ø)

[aeneasr]

Thank you for the PR! Could you please summarize what this feature does and how it works? Thank you! :)

[akselleirv]

Thank you for the PR! Could you please summarize what this feature does and how it works? Thank you! :)

Hello @aeneasr,

One use-case I have is that I want to check if the JWT has the expected subject. For example, one of the rules I have only permits a user which has the sub field set to some value.

An example config would look like:

- id: check-sub
  upstream:
    url: https://example.com
  match:
    url: https://example.com
    methods:
      - GET
      - POST
  authenticators:
    - handler: jwt
      config:
        allowed_algorithms:
          - RS256
        jwks_urls:
          - https://example.com
        trusted_issuers:
          - https://example.com
        token_from:
          header: X-Id-Token
        target_audience: []
  authorizer:
    - handler: allow_if
      config:
        key: "{{ .Subject }}"
        op: Equals
        value: aeneasr

Another use-case would be to check if some header equals a value:

  authorizer:
    - handler: allow_if
      config:
        key: "{{ .Header.some-key }}"
        op: Equals
        value: some-value

[akselleirv]

@aeneasr do you have time to look at this again?