Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[#375] Add optional strict check to aud member of introspection endpoint response #378

Merged
merged 1 commit into from
Dec 12, 2024
Merged

[#375] Add optional strict check to aud member of introspection endpoint response #378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,6 +257,12 @@ Notice how some of the configuration values are wrapped in angle brackets (e.g.
// If provided, it MUST be base64url encoded.
"nonstandard_id_token_secret": "xxxxxxxxxxxxxxx",

// Controls whether the HTTP API requires the presence of the
// "aud" member in the introspection endpoint response. If set
// to true and the "aud" member is NOT present, the provided
// access token will be rejected.
"require_aud_member_from_introspection_endpoint": false,

// The OIDC mode the HTTP API will run as.
// The following values are supported:
// - client: Run the HTTP API as an OIDC client
Expand Down
5 changes: 5 additions & 0 deletions core/src/main.cpp
View file
Open in desktop
MartinFlores751 marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,9 @@ constexpr auto default_jsonschema() -> std::string_view
"nonstandard_id_token_secret": {{
"type": "string"
}},
"require_aud_member_from_introspection_endpoint": {{
"type": "boolean"
}},
"redirect_uri": {{
trel marked this conversation as resolved.
Show resolved Hide resolved
"type": "string",
"format": "uri"
Expand Down Expand Up @@ -264,6 +267,7 @@ constexpr auto default_jsonschema() -> std::string_view
"provider_url",
"mode",
"client_id",
"require_aud_member_from_introspection_endpoint",
"redirect_uri",
trel marked this conversation as resolved.
Show resolved Hide resolved
"tls_certificates_directory",
"user_mapping"
Expand Down Expand Up @@ -508,6 +512,7 @@ auto print_configuration_template() -> void
"client_id": "<string>",
"client_secret": "<string>",
"mode": "client",
"require_aud_member_from_introspection_endpoint": false,
"redirect_uri": "<string>",
trel marked this conversation as resolved.
Show resolved Hide resolved
"user_mapping": {{
"plugin_path": "<string>",
Expand Down
14 changes: 9 additions & 5 deletions core/src/openid.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,12 +154,16 @@ namespace irods::http::openid
logging::warn("{}: Could not find our [client_id] in [aud]. Validation failed.", __func__);
return std::nullopt;
}
}
// Some IAM servers (e.g. keycloak) could be set up
// to exclude `aud' from a bearer token payload
// If no 'aud' was found in bearer token, do not accept
} else {
logging::warn("{}: Bearer token payload is missing [aud]. Validation failed.", __func__);
return std::nullopt;
// to exclude 'aud' from a bearer token payload.
// If no 'aud' was found in bearer token, do not accept.
else if (auto strict_aud{
irods::http::globals::oidc_configuration().find("require_aud_member_from_introspection_endpoint")};
strict_aud != std::end(irods::http::globals::oidc_configuration()) && strict_aud->get<bool>())
{
logging::warn("{}: Bearer token payload is missing [aud]. Validation failed.", __func__);
return std::nullopt;
}

// The 'iss' provided should match the 'issuer' retrieved from the OpenID Provider's
Expand Down
Loading