refactor: prepare for private_key_jwt in oauth_client_details #2433
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
BaseClientDetails from spring security oauth2 cannot be changed, therefore more to UaaClientDetails for client details load
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/185779265 The labels on this github issue will be updated when the story is started. |
|
@Tallicia @bruce-ricard can you please review this PR ? |
…sue/2235/refactorClient
…sue/2235/refactorClient
…sue/2235/refactorClient
Even if UaaClientDetails is used the addClientDetails method can be used and therefore it does not make sense to have 2 add methods
server/src/main/java/org/cloudfoundry/identity/uaa/client/UaaClientDetails.java
Outdated
Show resolved
Hide resolved
...er/src/main/java/org/cloudfoundry/identity/uaa/zone/MultitenantJdbcClientDetailsService.java
Show resolved
Hide resolved
server/src/test/java/org/cloudfoundry/identity/uaa/client/UaaClientDetailsTest.java
Show resolved
Hide resolved
server/src/test/java/org/cloudfoundry/identity/uaa/client/UaaClientDetailsTest.java
Show resolved
Hide resolved
...c/test/java/org/cloudfoundry/identity/uaa/zone/MultitenantJdbcClientDetailsServiceTests.java
Show resolved
Hide resolved
…sue/2235/refactorClient
hsinn0
approved these changes
Sep 14, 2023
tack-sap
approved these changes
Sep 14, 2023
strehle
added a commit
that referenced
this pull request
Oct 12, 2023
#2507) * feature: add runtime support for private_key_jwt client authentication More details in #2449, in #2433 as this PR include #2433. -> because to have smaller review packages Enable the validation of client_assertion as replacement for client_secret Add private_key_jwt as client_auth_method into tokens. * review * fix smells from sonar https://sonarcloud.io/summary/new_code?id=cloudfoundry-identity-parent&pullRequest=2507
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
BaseClientDetails from spring security oauth2 cannot be changed, therefore move to UaaClientDetails for client details load
Add new column : client_jwt_config
The content of client_jwt_config will be JSON . The PR #2449 will make use of this
The client jwt authentication is based on JsonWebKey trust. See https://datatracker.ietf.org/doc/html/rfc7517
The internal store can contain either.
The idea is, that with such a trust you can now configure in your zone1 a client with jwks_uri pointing to system zone, e.g. http://localhost:8080/uaa/token_keys . Now you define a OIDC identity provider object with jwtClientAuthentication: true and your set in tokenKeyUrl the other jwks_uri, e.g. http://zone.localhost:8080/uaa/token_keys
Now you have jwt based client authentication between zones: uaa and zone.
You can also add other clients in customer zone where client trust is set to http://localhost:8080/uaa/token_keys (system uaa zone) and then you do other calls but the client in the customer zone always trusts your system zone, even if you update your own JWT signing keys.