feat(proxy): add optional OIDC access token audience validation - #3466
Open
zerox80 wants to merge 2 commits into
Open
feat(proxy): add optional OIDC access token audience validation#3466zerox80 wants to merge 2 commits into
zerox80 wants to merge 2 commits into
Conversation
Validate configured audiences on signed access tokens before cache lookup, while preserving cached Userinfo and the default behavior. Add local IdP integration tests, configuration coverage and production guidance.
Use the supported %%NEXT%% marker for seven graph and policies settings so the environment annotation check passes.
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 84 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add optional OIDC access token audience validation through
PROXY_OIDC_AUDIENCESoroidc.audiencesinproxy.yaml. The list defaults to empty for compatibility. When configured, a token must contain at least one exact, case-sensitive match in itsaudclaim. Missing, empty, malformed and nonmatching audiences are rejected.The signed access token is checked before every Userinfo cache lookup, so existing cache entries cannot bypass a changed audience policy. Cache misses reuse the verification result, and cache hits still avoid extra Userinfo requests. The proxy rejects audience configuration with verification disabled and logs one startup warning when audience validation is off.
The documentation includes ENV and YAML examples, IdP setup requirements and a recommendation to enable the check in production. A separate commit fixes seven existing version annotation typos found by the annotation check.
Related Issue
Fixes #3456
Motivation and Context
When an IdP serves several applications, OpenCloud can currently accept an otherwise valid access token issued for another application. This gives administrators an explicit way to restrict tokens to OpenCloud without breaking existing IdP configurations by default.
How Has This Been Tested?
Tested on Ubuntu WSL with Go 1.25.9 and GCC, using the vendored dependencies.
go test -mod=vendor -race -count=1 ./pkg/oidc/... ./services/proxy/...passed.make testpassed with a local OpenSearch 2 instance..make/check-env-var-annotations.shpassed.make ci-golangci-lintcompleted. The repository has existing lint findings; a separate run against this diff reported no new findings.The new tests use locally generated keys and an HTTP test IdP with discovery, JWKS and Userinfo endpoints. They cover both
skip_user_infosettings, cached tokens after policy changes, expiry, logout invalidation, ENV/YAML precedence and the startup warning. They also retain signature, issuer,nbfand AD FS issuer checks. No external IdP is needed.GPT 6 Astra was used as a supporting tool for the implementation and tests.
Types of changes
Checklist
HTTP integration tests are included in the Go suite. The Behat acceptance suite was not extended.