send audience to tokenreview api (#74)

hashicorp · Dec 3, 2019 · c59da59 · c59da59
1 parent 2e5b0b8
commit c59da59
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/path_login.go b/path_login.go
@@ -351,7 +351,7 @@ type projectedServiceAccountPod struct {
 // lookup calls the TokenReview API in kubernetes to verify the token and secret
 // still exist.
 func (s *serviceAccount) lookup(jwtStr string, tr tokenReviewer) error {
-	r, err := tr.Review(jwtStr)
+	r, err := tr.Review(jwtStr, s.Audience)
 	if err != nil {
 		return err
 	}

diff --git a/token_review.go b/token_review.go
@@ -28,7 +28,7 @@ type tokenReviewResult struct {
 
 // This exists so we can use a mock TokenReview when running tests
 type tokenReviewer interface {
-	Review(string) (*tokenReviewResult, error)
+	Review(string, []string) (*tokenReviewResult, error)
 }
 
 type tokenReviewFactory func(*kubeConfig) tokenReviewer
@@ -44,7 +44,7 @@ func tokenReviewAPIFactory(config *kubeConfig) tokenReviewer {
 	}
 }
 
-func (t *tokenReviewAPI) Review(jwt string) (*tokenReviewResult, error) {
+func (t *tokenReviewAPI) Review(jwt string, aud []string) (*tokenReviewResult, error) {
 
 	client := cleanhttp.DefaultClient()
 
@@ -64,7 +64,8 @@ func (t *tokenReviewAPI) Review(jwt string) (*tokenReviewResult, error) {
 	// Create the TokenReview Object and marshal it into json
 	trReq := &authv1.TokenReview{
 		Spec: authv1.TokenReviewSpec{
-			Token: jwt,
+			Token:     jwt,
+			Audiences: aud,
 		},
 	}
 	trJSON, err := json.Marshal(trReq)
@@ -187,7 +188,7 @@ func mockTokenReviewFactory(name, namespace, UID string) tokenReviewFactory {
 	}
 }
 
-func (t *mockTokenReview) Review(jwt string) (*tokenReviewResult, error) {
+func (t *mockTokenReview) Review(jwt string, aud []string) (*tokenReviewResult, error) {
 	return &tokenReviewResult{
 		Name:      t.saName,
 		Namespace: t.saNamespace,