Repository: clouditor/clouditor
Pull request #997 (2023-03-07 13:17:35)

Retrieve allow all authorisation decision from JWT

codecov[bot]: # [Codecov](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) Report
> Merging [#997](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (8182f12) into [main](https://codecov.io/gh/clouditor/clouditor/commit/87d055a309f6f0cc2676cb8a996050f6c636125d?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) (87d055a) will **increase** coverage by `0.05%`.
> The diff coverage is `50.00%`.

```diff
@@            Coverage Diff             @@
##             main     #997      +/-   ##
==========================================
+ Coverage   81.88%   81.93%   +0.05%     
==========================================
  Files          89       89              
  Lines        7573     7596      +23     
==========================================
+ Hits         6201     6224      +23     
  Misses       1052     1052              
  Partials      320      320              
```

| Flag | Coverage Δ | |
|---|---|---|
| unittests | `81.93% <50.00%> (+0.05%)` | :arrow_up: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor) | Coverage Δ | |
|---|---|---|
| [internal/testutil/auth.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-aW50ZXJuYWwvdGVzdHV0aWwvYXV0aC5nbw==) | `90.56% <ø> (ø)` | |
| [service/authz.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9hdXRoei5nbw==) | `93.47% <25.00%> (-6.53%)` | :arrow_down: |
| [service/orchestrator/orchestrator.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9vcmNoZXN0cmF0b3Ivb3JjaGVzdHJhdG9yLmdv) | `78.00% <100.00%> (ø)` | |
| [internal/testutil/orchestratortest/orchestrator.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-aW50ZXJuYWwvdGVzdHV0aWwvb3JjaGVzdHJhdG9ydGVzdC9vcmNoZXN0cmF0b3IuZ28=) | `100.00% <0.00%> (ø)` | |
| [service/orchestrator/catalogs.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9vcmNoZXN0cmF0b3IvY2F0YWxvZ3MuZ28=) | `77.71% <0.00%> (+0.38%)` | :arrow_up: |
| [service/assessment/assessment.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9hc3Nlc3NtZW50L2Fzc2Vzc21lbnQuZ28=) | `89.58% <0.00%> (+0.78%)` | :arrow_up: |
| [service/orchestrator/toe.go](https://codecov.io/gh/clouditor/clouditor/pull/997?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor#diff-c2VydmljZS9vcmNoZXN0cmF0b3IvdG9lLmdv) | `80.83% <0.00%> (+1.10%)` | :arrow_up: |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clouditor)


Patch:
diff --git a/service/authz.go b/service/authz.go
index ccb0a734..95ca1a86 100644
--- a/service/authz.go
+++ b/service/authz.go
@@ -60,16 +60,24 @@ type AuthorizationStrategy interface {
 // AuthorizationStrategyJWT is an AuthorizationStrategy that expects a list of cloud service IDs to be in a specific JWT
 // claim key.
 type AuthorizationStrategyJWT struct {
-	Key string
+	CloudServicesKey string
+	AllowAllKey      string
 }
 
 // CheckAccess checks whether the current request can be fulfilled using the current access strategy.
 func (a *AuthorizationStrategyJWT) CheckAccess(ctx context.Context, _ RequestType, req api.CloudServiceRequest) bool {
-	var list []string
+	var (
+		list []string
+		all  bool
+	)
 
 	// Retrieve the list of allowed cloud services. we never allow to retrieve
 	// "all" services with the token strategy.
-	_, list = a.AllowedCloudServices(ctx)
+	all, list = a.AllowedCloudServices(ctx)
+
+	if all {
+		return true
+	}
 
 	return slices.Contains(list, req.GetCloudServiceId())
 }
@@ -100,8 +108,13 @@ func (a *AuthorizationStrategyJWT) AllowedCloudServices(ctx context.Context) (al
 		return false, nil
 	}
 
+	// Let's look for an allow all key
+	if b, ok := claims[a.AllowAllKey].(bool); ok && b {
+		return true, nil
+	}
+
 	// We are looking for an array claim
-	if l, ok = claims[a.Key].([]interface{}); !ok {
+	if l, ok = claims[a.CloudServicesKey].([]interface{}); !ok {
 		log.Debug("Retrieving allowed cloud services from token failed: specified claims key is not an array", err)
 		return false, nil
 	}
diff --git a/service/orchestrator/orchestrator.go b/service/orchestrator/orchestrator.go
index 3c40ed1e..88de3b5a 100644
--- a/service/orchestrator/orchestrator.go
+++ b/service/orchestrator/orchestrator.go
@@ -137,9 +137,9 @@ func WithStorage(storage persistence.Storage) ServiceOption {
 }
 
 // WithAuthorizationStrategyJWT is an option that configures an JWT-based authorization strategy using a specific claim key.
-func WithAuthorizationStrategyJWT(key string) ServiceOption {
+func WithAuthorizationStrategyJWT(key string, allowAllKey string) ServiceOption {
 	return func(s *Service) {
-		s.authz = &service.AuthorizationStrategyJWT{Key: key}
+		s.authz = &service.AuthorizationStrategyJWT{CloudServicesKey: key, AllowAllKey: allowAllKey}
 	}
 }
 


Test patch:
diff --git a/internal/testutil/auth.go b/internal/testutil/auth.go
index c4092923..2467abad 100644
--- a/internal/testutil/auth.go
+++ b/internal/testutil/auth.go
@@ -14,13 +14,13 @@ import (
 )
 
 const (
-	TestAuthUser     = "clouditor"
-	TestAuthPassword = "clouditor"
-
+	TestAuthUser         = "clouditor"
+	TestAuthPassword     = "clouditor"
+	TestCustomClaims     = "cloudserviceid"
+	TestAllowAllClaims   = "cladmin"
 	TestAuthClientID     = "client"
 	TestAuthClientSecret = "secret"
 
-	TestCustomClaims      = "cloudserviceid"
 	TestCloudService1     = "11111111-1111-1111-1111-111111111111"
 	TestCloudService2     = "22222222-2222-2222-2222-222222222222"
 	TestCloudServiceName1 = "My Cloud Service 1"
@@ -32,6 +32,9 @@ var (
 	// 11111111-1111-1111-1111-111111111111
 	TestContextOnlyService1 context.Context
 
+	// TestContextOnlyService1 is an incoming context with a JWT that allows access to all cloud services
+	TestContextAllowAll context.Context
+
 	// TestBrokenContext contains an invalid JWT
 	TestBrokenContext = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
 		"authorization": "bearer what",
@@ -46,6 +49,12 @@ var (
 		},
 		"other": []int{1, 2},
 	}
+
+	// TestClaimsOnlyService1 contains claims that authorize the user for all cloud services.
+	TestClaimsAllowAll = jwt.MapClaims{
+		"sub":     "me",
+		"cladmin": true,
+	}
 )
 
 func init() {
@@ -66,6 +75,17 @@ func init() {
 	TestContextOnlyService1 = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
 		"authorization": "bearer " + t,
 	}))
+
+	token = jwt.NewWithClaims(jwt.SigningMethodHS256, &TestClaimsAllowAll)
+	t, err = token.SignedString([]byte("mykey"))
+	if err != nil {
+		panic(err)
+	}
+
+	// Create a context containing our token
+	TestContextAllowAll = metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{
+		"authorization": "bearer " + t,
+	}))
 }
 
 // StartAuthenticationServer starts an authentication server on a random port with
diff --git a/service/authz_test.go b/service/authz_test.go
index 7b727857..f8fe6552 100644
--- a/service/authz_test.go
+++ b/service/authz_test.go
@@ -104,7 +104,8 @@ func TestAuthorizationStrategyAllowAll_AllowedCloudServices(t *testing.T) {
 
 func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 	type fields struct {
-		Key string
+		CloudServicesKey string
+		AllowAllKey      string
 	}
 	type args struct {
 		ctx context.Context
@@ -120,7 +121,7 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 		{
 			name: "valid context",
 			fields: fields{
-				Key: testutil.TestCustomClaims,
+				CloudServicesKey: testutil.TestCustomClaims,
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -129,10 +130,22 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "valid context, allow all",
+			fields: fields{
+				AllowAllKey: testutil.TestAllowAllClaims,
+			},
+			args: args{
+				ctx: testutil.TestContextAllowAll,
+				typ: AccessRead,
+				req: &orchestrator.GetCloudServiceRequest{CloudServiceId: testutil.TestCloudService1},
+			},
+			want: true,
+		},
 		{
 			name: "valid context, wrong claim",
 			fields: fields{
-				Key: "sub",
+				CloudServicesKey: "sub",
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -144,7 +157,7 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 		{
 			name: "valid context, ignore non-string",
 			fields: fields{
-				Key: "other",
+				CloudServicesKey: "other",
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -156,7 +169,7 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 		{
 			name: "missing token",
 			fields: fields{
-				Key: testutil.TestCustomClaims,
+				CloudServicesKey: testutil.TestCustomClaims,
 			},
 			args: args{
 				ctx: context.Background(),
@@ -168,7 +181,7 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 		{
 			name: "broken token",
 			fields: fields{
-				Key: testutil.TestCustomClaims,
+				CloudServicesKey: testutil.TestCustomClaims,
 			},
 			args: args{
 				ctx: testutil.TestBrokenContext,
@@ -182,7 +195,8 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			a := &AuthorizationStrategyJWT{
-				Key: tt.fields.Key,
+				CloudServicesKey: tt.fields.CloudServicesKey,
+				AllowAllKey:      tt.fields.AllowAllKey,
 			}
 			if got := a.CheckAccess(tt.args.ctx, tt.args.typ, tt.args.req); got != tt.want {
 				t.Errorf("AuthorizationStrategyJWT.CheckAccess() = %v, want %v", got, tt.want)
@@ -190,3 +204,102 @@ func TestAuthorizationStrategyJWT_CheckAccess(t *testing.T) {
 		})
 	}
 }
+
+func TestAuthorizationStrategyJWT_AllowedCloudServices(t *testing.T) {
+	type fields struct {
+		CloudServicesKey string
+		AllowAllKey      string
+	}
+	type args struct {
+		ctx context.Context
+	}
+	tests := []struct {
+		name     string
+		fields   fields
+		args     args
+		wantAll  bool
+		wantList []string
+	}{
+		{
+			name: "valid context",
+			fields: fields{
+				CloudServicesKey: testutil.TestCustomClaims,
+			},
+			args: args{
+				ctx: testutil.TestContextOnlyService1,
+			},
+			wantAll:  false,
+			wantList: []string{testutil.TestCloudService1},
+		},
+		{
+			name: "valid context, allow all",
+			fields: fields{
+				AllowAllKey: testutil.TestAllowAllClaims,
+			},
+			args: args{
+				ctx: testutil.TestContextAllowAll,
+			},
+			wantAll:  true,
+			wantList: nil,
+		},
+		{
+			name: "valid context, wrong claim",
+			fields: fields{
+				CloudServicesKey: "sub",
+			},
+			args: args{
+				ctx: testutil.TestContextOnlyService1,
+			},
+			wantAll:  false,
+			wantList: nil,
+		},
+		{
+			name: "valid context, ignore non-string",
+			fields: fields{
+				CloudServicesKey: "other",
+			},
+			args: args{
+				ctx: testutil.TestContextOnlyService1,
+			},
+			wantAll:  false,
+			wantList: nil,
+		},
+		{
+			name: "missing token",
+			fields: fields{
+				CloudServicesKey: testutil.TestCustomClaims,
+			},
+			args: args{
+				ctx: context.Background(),
+			},
+			wantAll:  false,
+			wantList: nil,
+		},
+		{
+			name: "broken token",
+			fields: fields{
+				CloudServicesKey: testutil.TestCustomClaims,
+			},
+			args: args{
+				ctx: testutil.TestBrokenContext,
+			},
+			wantAll:  false,
+			wantList: nil,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			a := &AuthorizationStrategyJWT{
+				CloudServicesKey: tt.fields.CloudServicesKey,
+				AllowAllKey:      tt.fields.AllowAllKey,
+			}
+			gotAll, gotList := a.AllowedCloudServices(tt.args.ctx)
+			if gotAll != tt.wantAll {
+				t.Errorf("AuthorizationStrategyJWT.AllowedCloudServices() gotAll = %v, want %v", gotAll, tt.wantAll)
+			}
+			if !reflect.DeepEqual(gotList, tt.wantList) {
+				t.Errorf("AuthorizationStrategyJWT.AllowedCloudServices() gotList = %v, want %v", gotList, tt.wantList)
+			}
+		})
+	}
+}
diff --git a/service/evidence/evidence_store_test.go b/service/evidence/evidence_store_test.go
index c2d8cf2d..aad26493 100644
--- a/service/evidence/evidence_store_test.go
+++ b/service/evidence/evidence_store_test.go
@@ -316,7 +316,7 @@ func TestService_ListEvidences(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, 2, len(resp.Evidences))
 
-	s.authz = &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims}
+	s.authz = &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims}
 
 	resp, err = s.ListEvidences(testutil.TestContextOnlyService1, &evidence.ListEvidencesRequest{})
 	assert.NoError(t, err)
@@ -619,9 +619,7 @@ func TestService_GetEvidence(t *testing.T) {
 						Timestamp:      timestamppb.Now(),
 					}))
 				}),
-				authz: &service.AuthorizationStrategyJWT{
-					Key: testutil.TestCustomClaims,
-				},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
diff --git a/service/orchestrator/assessment_results_test.go b/service/orchestrator/assessment_results_test.go
index bf031553..1aed25d1 100644
--- a/service/orchestrator/assessment_results_test.go
+++ b/service/orchestrator/assessment_results_test.go
@@ -118,7 +118,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -138,7 +138,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -158,7 +158,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult1))
 					assert.NoError(t, s.Create(&orchestratortest.MockAssessmentResult2))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -179,7 +179,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -201,7 +201,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -268,7 +268,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -290,7 +290,7 @@ func TestService_ListAssessmentResults(t *testing.T) {
 				storage: testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 					assert.NoError(t, s.Create(orchestratortest.MockAssessmentResults))
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
diff --git a/service/orchestrator/cloud_service_test.go b/service/orchestrator/cloud_service_test.go
index 8e6b0d25..2c60284e 100644
--- a/service/orchestrator/cloud_service_test.go
+++ b/service/orchestrator/cloud_service_test.go
@@ -159,7 +159,7 @@ func TestService_GetCloudService(t *testing.T) {
 		},
 		{
 			name: "permission denied",
-			svc:  NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims)),
+			svc:  NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims, testutil.TestAllowAllClaims)),
 			ctx:  testutil.TestContextOnlyService1,
 			req:  &orchestrator.GetCloudServiceRequest{CloudServiceId: DefaultTargetCloudServiceId},
 			res:  nil,
@@ -170,7 +170,7 @@ func TestService_GetCloudService(t *testing.T) {
 		},
 		{
 			name: "permission granted",
-			svc: NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims), WithStorage(testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
+			svc: NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims, testutil.TestAllowAllClaims), WithStorage(testutil.NewInMemoryStorage(t, func(s persistence.Storage) {
 				_ = s.Create(&orchestrator.CloudService{
 					Id:   testutil.TestCloudService1,
 					Name: "service1",
@@ -210,7 +210,7 @@ func TestService_UpdateCloudService(t *testing.T) {
 		cloudService *orchestrator.CloudService
 		err          error
 	)
-	orchestratorService := NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims))
+	orchestratorService := NewService(WithAuthorizationStrategyJWT(testutil.TestCustomClaims, testutil.TestAllowAllClaims))
 
 	// 1st case: Service is nil
 	_, err = orchestratorService.UpdateCloudService(testutil.TestContextOnlyService1, &orchestrator.UpdateCloudServiceRequest{})
@@ -394,7 +394,7 @@ func TestService_ListCloudServices(t *testing.T) {
 						Name: testdata.MockCloudServiceName,
 					})
 				}),
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims, AllowAllKey: testutil.TestAllowAllClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
diff --git a/service/orchestrator/toe_test.go b/service/orchestrator/toe_test.go
index 8abd8531..329c1ec8 100644
--- a/service/orchestrator/toe_test.go
+++ b/service/orchestrator/toe_test.go
@@ -694,7 +694,7 @@ func TestService_ListControlsInScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
 			},
 			args: args{
 				ctx: testutil.TestContextOnlyService1,
@@ -837,7 +837,7 @@ func TestService_AddControlToScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
 			},
 			args: args{
 				in0: testutil.TestContextOnlyService1,
@@ -958,7 +958,7 @@ func TestService_UpdateControlInScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
 			},
 			args: args{
 				in0: testutil.TestContextOnlyService1,
@@ -1062,7 +1062,7 @@ func TestService_RemoveControlFromScope(t *testing.T) {
 		{
 			name: "permission denied",
 			fields: fields{
-				authz: &service.AuthorizationStrategyJWT{Key: testutil.TestCustomClaims},
+				authz: &service.AuthorizationStrategyJWT{CloudServicesKey: testutil.TestCustomClaims},
 			},
 			args: args{
 				in0: testutil.TestContextOnlyService1,