-
Notifications
You must be signed in to change notification settings - Fork 606
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
oidc impersonation #11449
oidc impersonation #11449
Conversation
6964f88
to
67b9241
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
67b9241
to
2274f9e
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
2274f9e
to
09ddc18
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
09ddc18
to
700e978
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
700e978
to
4c2f031
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
4c2f031
to
f12608f
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
f12608f
to
94ddfa3
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
94ddfa3
to
c348947
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
37fb58b
to
767932d
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
31a8bd5
to
25c51d0
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
25c51d0
to
18ba292
Compare
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
⚪ Test history | Ya make output | Test bloat
🟢 |
Changelog entry
https://nebius.atlassian.net/browse/NBYDB-594
oidc impersonation adds impersonated cookie that could be used instead session cookie
to get impersonated cookie session cookie and service-account-id could be used
2 oidc impersonate handler were added
/impersonate/start
to add impersonated cookie/impersonate/stop
to remove impersonated cookieIf request to oidc happens, it checks new impersonated cookie. if exists, oidc uses it for next authentification
If the authentication domain returns a status code of 400 or 401, OIDC performs a redirect with a 307 status code to the same address and clears the impersonated cookie.
Changelog category
Additional information
Examples:
curl -i 'https://oidc.net/impersonate/start?service_account_id=serviceaccount-e0tydb-dev'
-H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7'
-H 'cookie: __Host_session_cookie_6D76702D6F6964632D74657374696E67=****'
--insecure
expected result:
set-cookie: __Host_impersonated_cookie_6D76702D6F6964632D74657374696E67=****; Path=/; Secure; HttpOnly; SameSite=None; Partitioned
curl -i 'https://oidc.net/impersonate/start?service_account_id=service-account-name'
-H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7'
-H 'cookie: __Host_session_cookie_6D76702D6F6964632D74657374696E67=****'
--insecure
expected result:
set-cookie: __Host_impersonated_cookie_6D76702D6F6964632D74657374696E67=; Path=/; Secure; HttpOnly; SameSite=None; Partitioned; Max-Age=0
curl 'https://oidc.net/storage-status.ydb-global.ik8s-beta.ik8s.man.nbhost.net:8765/viewer/json/describe?database=%2Ftesting%2Fcharlotte&path=%2Ftesting%2Fcharlotte&enums=true&backup=false&private=true&partition_config=false&partition_stats=false&partitioning_info=false&subs=1'
-H 'accept: application/json, text/plain, /'
-H 'cookie: __Host_session_cookie_6D76702D6F6964632D74657374696E67=; __Host_impersonated_cookie_6D76702D6F6964632D74657374696E67=; _ga_N2V9EEXZGE=GS1.1.1731507944.10.1.1731507976.0.0.0'
--insecure
If the authentication domain returns a status code of 400 or 401, OIDC performs a redirect with a 307 status code to the same address and clears the impersonated cookie.
...