AlinsRan commented on code in PR #13649:
URL: https://github.com/apache/apisix/pull/13649#discussion_r3671970343
##########
apisix-master-0.rockspec:
##########
@@ -51,7 +51,7 @@ dependencies = {
"opentracing-openresty = 0.1-0",
"lua-resty-radixtree = 2.9.2-0",
"lua-protobuf = 0.5.3-1",
- "lua-resty-openidc = 1.8.0-1",
+ "lua-resty-openidc = 1.9.0-1",
Review Comment:
The 1.8.0 -> 1.9.0 bump also changes behavior for existing configurations,
beyond the opt-in PAR/DPoP options.
1.9.0 only puts `client_id`/`client_secret` in the introspection POST body
when `introspection_endpoint_auth_method` is nil (`openidc.lua:2337`); 1.8.0
did it unconditionally. This Plugin defaults that attribute to
`client_secret_basic`, and the default reaches the conf handed to the library
on both paths, so after the bump introspection credentials travel only in the
`Authorization` header. An OP that authenticates the introspection call from
the body breaks with an unchanged APISIX config; the workaround is
`introspection_endpoint_auth_method: "client_secret_post"`.
Addressed in c74b8fb: upgrade note in both docs, and TEST 66 pins where the
credentials land for all three settings.
##########
apisix-master-0.rockspec:
##########
@@ -51,7 +51,7 @@ dependencies = {
"opentracing-openresty = 0.1-0",
"lua-resty-radixtree = 2.9.2-0",
"lua-protobuf = 0.5.3-1",
- "lua-resty-openidc = 1.8.0-1",
+ "lua-resty-openidc = 1.9.0-1",
Review Comment:
One addition here: this is testable without a live OP, which would keep the
behavior from changing again unnoticed. A mock introspection endpoint that
reports whether the credentials arrived in the POST body or in the
`Authorization` header, driven through a `bearer_only` route, pins all three
cases:
```
introspection_endpoint_auth_method unset -> body=false header=true
introspection_endpoint_auth_method basic -> body=false header=true
introspection_endpoint_auth_method post -> body=true header=false
```
The first line is the one that matters: it is `false` only because the
schema default injects `client_secret_basic` before the conf reaches the
library. Removing that default flips it to `body=true header=false`, which is
the 1.8.0 behavior — so the test fails exactly when this interaction changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
