Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: add additional OIDC auth resolvers #2020

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: add additional OIDC auth resolvers #2020

wants to merge 1 commit into from
+95 −0

Conversation

JessicaJHee
Copy link
Member

Description

Adds the oidcSubClaimMatchingKeycloakUserId and oidcSubClaimMatchingPingIdentityUserId resolvers that resolve based on the more secure, sub claim from OIDC.

Which issue(s) does this PR fix

PR acceptance criteria

Please make sure that the following steps are complete:

  • GitHub Actions are completed and successful
  • Unit Tests are updated and passing
  • E2E Tests are updated and passing
  • Documentation is updated if necessary (requirement for new features)
  • Add a screenshot if the change is UX/UI related

@JessicaJHee JessicaJHee requested a review from a team as a code owner November 28, 2024 23:12
@JessicaJHee JessicaJHee changed the title add additional OIDC auth resolvers chore: add additional OIDC auth resolvers Nov 28, 2024
@github-actions GitHub Actions
Copy link
Contributor

The image is available at:

@github-actions GitHub Actions
Copy link
Contributor

The image is available at:

kim-tsao
kim-tsao reviewed Dec 2, 2024
View reviewed changes
Copy link
Member

@kim-tsao kim-tsao left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is for 1.5 only. DO NOT BACKPORT

@JessicaJHee
Copy link
Member Author

@kim-tsao I found this recommendation in the OIDC specs while looking into the userinfo response:

"Due to the possibility of token substitution attacks (see Section 16.11), the UserInfo Response is not guaranteed to be about the End-User identified by the sub (subject) element of the ID Token. The sub Claim in the UserInfo Response MUST be verified to exactly match the sub Claim in the ID Token; if they do not match, the UserInfo Response values MUST NOT be used."

I've added a check to satisfy this requirement in this PR as well 👍

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 2, 2024

The image is available at:

@JessicaJHee JessicaJHee force-pushed the add-oidc-resolver branch 2 times, most recently from 8e58de5 to 6ad8b29 Compare December 3, 2024 21:28
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Dec 6, 2024

The image is available at:

@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Dec 18, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jessicajhee. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions GitHub Actions
Copy link
Contributor

The image is available at:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kim-tsao kim-tsao kim-tsao left review comments

@dzemanov dzemanov Awaiting requested review from dzemanov

@its-mitesh-kumar its-mitesh-kumar Awaiting requested review from its-mitesh-kumar

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@JessicaJHee @kim-tsao @openshift-merge-robot