Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add flag --disable_jwt_audience_service_name_check #779

Merged
merged 3 commits into from
Jan 18, 2023

Conversation

qiwzhang
Copy link
Contributor

@qiwzhang qiwzhang commented Jan 18, 2023

To fix: #706

Normally JWT "aud" field is checked against audiences specified in OpenAPI x-google-audiences field.
This flag changes the behavior when the x-google-audiences is not specified.
When the x-google-audiences is not specified, normally the service name is used to check the JWT aud field.
If this flag is true, the service name is not used, JWT aud field will not be checked.

@qiwzhang
Copy link
Contributor Author

/retest

1 similar comment
@qiwzhang
Copy link
Contributor Author

/retest

@qiwzhang
Copy link
Contributor Author

PTAL

@qiwzhang qiwzhang changed the title Add flag --disable_jwt_aud_check Add flag --disable_jwt_audience_service_name_check Jan 18, 2023
Copy link
Contributor

@nareddyt nareddyt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adjusting the flag!

@google-oss-prow google-oss-prow bot added the lgtm label Jan 18, 2023
@google-oss-prow
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nareddyt, qiwzhang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@qiwzhang
Copy link
Contributor Author

/retest

@google-oss-prow
Copy link

@qiwzhang: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ESPv2-anthos-cloud-run-e2e-anthos-cloud-run-http-bookstore 72255bb link true /test ESPv2-anthos-cloud-run-e2e-anthos-cloud-run-http-bookstore
ESPv2-presubmit-asan 72255bb link true /test ESPv2-presubmit-asan

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@qiwzhang qiwzhang merged commit 7d7fd2c into GoogleCloudPlatform:master Jan 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add ability to disable JWT audience checking in ESPv2
3 participants