Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: include OIDC JWKSet in the gateway JWKs #3499

Merged
merged 6 commits into from
Apr 8, 2024
Merged

feat: include OIDC JWKSet in the gateway JWKs #3499

merged 6 commits into from
Apr 8, 2024

Conversation

achmelo
Copy link
Member

@achmelo achmelo commented Apr 5, 2024

Description

Include JWKs retrieved from the Identity Provider to allow clients and services to validate the OIDC access token locally.

Linked to #3455
Part of the # (epic)

Type of change

Please delete options that are not relevant.

  • fix: Bug fix (non-breaking change which fixes an issue)
  • feat: New feature (non-breaking change which adds functionality)
  • docs: Change in a documentation
  • refactor: Refactor the code
  • chore: Chore, repository cleanup, updates the dependencies.
  • BREAKING CHANGE or !: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

  • My code follows the style guidelines of this project
  • PR title conforms to commit message guideline ## Commit Message Structure Guideline
  • I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • The java tests in the area I was working on leverage @nested annotations
  • Any dependent changes have been merged and published in downstream modules

For more details about how should the code look like read the Contributing guideline

@github-actions github-actions bot added the Sensitive Sensitive change that requires peer review label Apr 5, 2024
@achmelo
change debug message
71c3d5e 
Signed-off-by: achmelo <[email protected]>
@achmelo
test coverage
3f23330 
Signed-off-by: achmelo <[email protected]>
@pull-request-size pull-request-size bot added size/XL and removed size/L labels Apr 5, 2024
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Apr 5, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@achmelo achmelo merged commit a588a8f into v2.x.x Apr 8, 2024
31 checks passed
@delete-merged-branch delete-merged-branch bot deleted the reboot/oidc-jwk branch April 8, 2024 07:07
achmelo added a commit that referenced this pull request Apr 23, 2024
@achmelo
feat: include OIDC JWKSet in the gateway JWKs (#3499)
1b94c15 
* use the same JWK format, include OIDC keys in the response

Signed-off-by: achmelo <[email protected]>

* cleanup, update tests

Signed-off-by: achmelo <[email protected]>

* integration test for local validation

Signed-off-by: achmelo <[email protected]>

* set default ssl factory

Signed-off-by: achmelo <[email protected]>

* change debug message

Signed-off-by: achmelo <[email protected]>

* test coverage

Signed-off-by: achmelo <[email protected]>

---------

Signed-off-by: achmelo <[email protected]>

(cherry picked from commit a588a8f)
Signed-off-by: achmelo <[email protected]>
achmelo added a commit that referenced this pull request Apr 24, 2024
@achmelo @taban03
@balhar-jakub @pj892031
chore: v2 cherry pick (#3516)
c9dd4aa 
* fix: allow key exchange port configuration (#3453)

* allow key exchange port configuration

Signed-off-by: achmelo <[email protected]>

* explain different defaults for the port

Signed-off-by: achmelo <[email protected]>

* use the same default port number

Signed-off-by: achmelo <[email protected]>

---------

Signed-off-by: achmelo <[email protected]>
(cherry picked from commit d82322e)

* chore: Change log levels for WS and Identity Mapper and add service info (#3344)

* add info about the southbound service request for authsource

Signed-off-by: at670475 <[email protected]>

* add debug msg for websocket routing

Signed-off-by: at670475 <[email protected]>

* address pr comments

Signed-off-by: at670475 <[email protected]>

---------

Signed-off-by: at670475 <[email protected]>
(cherry picked from commit 0a888f8)

* fix: Respect configuration enabling JWT Token Refresh Functionality #3468 (#3474)

* Respect JWT Refresh Configuration from zowe.yaml

Signed-off-by: Jakub Balhar <[email protected]>

* Fix the default in shell.

Signed-off-by: Jakub Balhar <[email protected]>

---------

Signed-off-by: Jakub Balhar <[email protected]>
(cherry picked from commit b4146be)

* feat: include OIDC JWKSet in the gateway JWKs (#3499)

* use the same JWK format, include OIDC keys in the response

Signed-off-by: achmelo <[email protected]>

* cleanup, update tests

Signed-off-by: achmelo <[email protected]>

* integration test for local validation

Signed-off-by: achmelo <[email protected]>

* set default ssl factory

Signed-off-by: achmelo <[email protected]>

* change debug message

Signed-off-by: achmelo <[email protected]>

* test coverage

Signed-off-by: achmelo <[email protected]>

---------

Signed-off-by: achmelo <[email protected]>

(cherry picked from commit a588a8f)
Signed-off-by: achmelo <[email protected]>

* feat: forward valid OIDC token to southbound service in case of distributed ID is not mapped (#3497)

* forward token and message in case of missing mapping

Signed-off-by: at670475 <[email protected]>

* fix test

Signed-off-by: at670475 <[email protected]>

* add unit test

Signed-off-by: at670475 <[email protected]>

* small refactoring

Signed-off-by: at670475 <[email protected]>

* updating integration tests

Signed-off-by: at670475 <[email protected]>

* add test

Signed-off-by: at670475 <[email protected]>

* add exception to the error handler to return correct response code

Signed-off-by: at670475 <[email protected]>

* fix styles

Signed-off-by: achmelo <[email protected]>

---------

Signed-off-by: at670475 <[email protected]>
Signed-off-by: achmelo <[email protected]>
Co-authored-by: achmelo <[email protected]>
Co-authored-by: achmelo <[email protected]>
(cherry picked from commit 60777c1)

* fix: check for nullpointer exception when jwk key can't be retrieved (#3503)

* check for nullpointer ex when jwk key can't be retrieved

Signed-off-by: at670475 <[email protected]>

* add test

Signed-off-by: at670475 <[email protected]>

* address comment

Signed-off-by: at670475 <[email protected]>

---------

Signed-off-by: at670475 <[email protected]>
(cherry picked from commit 7c00dba)

* revert

Signed-off-by: achmelo <[email protected]>

* use current methods

Signed-off-by: achmelo <[email protected]>

* feat: Move OIDC access token from cookie to special header (#3513)

* POC

Signed-off-by: Pavel Jares <[email protected]>

* fix

Signed-off-by: Pavel Jares <[email protected]>

* replace old constructors

Signed-off-by: achmelo <[email protected]>

* update IT

Signed-off-by: achmelo <[email protected]>

* fix

Signed-off-by: Pavel Jares <[email protected]>

* update IT

Signed-off-by: achmelo <[email protected]>

* fix IT

Signed-off-by: Pavel Jares <[email protected]>

* exception handler for no MF ID, unit test

Signed-off-by: achmelo <[email protected]>

* unit tests for request modification

Signed-off-by: Pavel Jares <[email protected]>

* license

Signed-off-by: achmelo <[email protected]>

* minor changes

Signed-off-by: Pavel Jares <[email protected]>

* lowercase header

Signed-off-by: achmelo <[email protected]>

* remove import

Signed-off-by: achmelo <[email protected]>

* remove authorization header from httpservletrequest

Signed-off-by: achmelo <[email protected]>

* test no ID and invalid token

Signed-off-by: achmelo <[email protected]>

* ignore cookies if auth cookie only remains

Signed-off-by: achmelo <[email protected]>

* expect no cookie in request

Signed-off-by: achmelo <[email protected]>

* fix sonar

Signed-off-by: Pavel Jares <[email protected]>

---------

Signed-off-by: Pavel Jares <[email protected]>
Signed-off-by: achmelo <[email protected]>
Co-authored-by: achmelo <[email protected]>
(cherry picked from commit 6248308)

* url without default

Signed-off-by: achmelo <[email protected]>

* use the same jwk uri

Signed-off-by: achmelo <[email protected]>

* attempt to fix IT

Signed-off-by: Pavel Jares <[email protected]>

* Revert "attempt to fix IT"

This reverts commit cf35400.

* use keyLocator for JWK set

Signed-off-by: achmelo <[email protected]>

---------

Signed-off-by: achmelo <[email protected]>
Signed-off-by: Pavel Jares <[email protected]>
Co-authored-by: Andrea Tabone <[email protected]>
Co-authored-by: Jakub Balhar <[email protected]>
Co-authored-by: Pavel Jareš <[email protected]>
Co-authored-by: Pavel Jares <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@taban03 taban03 taban03 approved these changes

Assignees
No one assigned
Labels
Sensitive Sensitive change that requires peer review size/XL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@achmelo @taban03