Configurable JWT Issuer for the OIDC Discovery Provider #5657
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com>
Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com>
Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com>
Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com>
Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com>
aluthra-37
requested review from
evan2645,
amartinezfayo,
azdagron,
MarcosDY and
rturner3
as code owners
rturner3
reviewed
Nov 22, 2024
There was a problem hiding this comment.
This looks pretty good overall to me, but I see some of the Windows OIDC Discovery Provider tests that were added in this PR are failing. @aluthra-37, would you mind fixing those up?
Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com>
kayhern
force-pushed
the
configurable-jwt-issuer-oidc-discovery-provider
branch
from
b468464 to
c3663a4
Compare
rturner3
approved these changes
Dec 3, 2024
|
This change has a bug.... When setting the issuer: The generated oidc config: Does not have the contacting port in the jwks_url, so it is invalid. The issuer override should only apply to issuer. |
Closed
|
It also now ignores the hostname contacted in favor of the hostname in jwt_issuer making the domains allowlist only work with the jwt_issuer as the entry. It allows any hostname in. This does not seem to be correct behavior. I think we need to talk more about the indended use cases. For my use case, I only need issuer set to jwt_issuer and nothing more. |
This was referenced Dec 10, 2024
graceajibade
pushed a commit
to graceajibade/spire
that referenced
this pull request
Dec 17, 2024
* Adding support for configurable jwt issuer + test cases Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> * Moving verifyhost check + adding more test cases Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> * Adding test case of jwt issuer with just a host Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> * Updating readme docs + fixing spacing Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> * Fixing spacing in readme table Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> * fixing windows test cases + minor refactor Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> --------- Signed-off-by: Luthra, Ayush <Ayush.Luthra@fmr.com> Signed-off-by: gajibade <gajibade@bloomberg.net>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request check list
Affected functionality
Added a config item to the OIDC provider (jwt_issuer). This config specifies the issuer for the OIDC provider configuration request. Previously, only the request host could be the issuer. This change allows users to define a different JWT issuer with a path.
Description of change
Which issue this PR fixes
Fix for #5480