Harrison Sheinblatt created KNOX-3434:
-----------------------------------------
Summary: Token validation for oidc trusted issuers skips typ
validation so k8s projected tokens can be used
Key: KNOX-3434
URL: https://issues.apache.org/jira/browse/KNOX-3434
Project: Apache Knox
Issue Type: Task
Components: JWT
Reporter: Harrison Sheinblatt
Currently all tokens are validated with a commonly configured type verifier.
k8s projected tokens do not include a typ header, and so would fail
verification. When token verification uses a TrustedOidcIssuer, registered as
an external issuer, then skip typ validation. This will allow k8s projected
tokens to be verified.
In the future, if other types of external issuers are to be registered, the
schema for the trusted issuer can be extended to include a flag controlling if
typ verification is to be skipped, or optionally which verifier to use. But for
now, this avoids having to dynamically update the list of issuers for which to
skip type verification separately from the trusted oidc issuer registration.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
