nic-6443 commented on code in PR #13649:
URL: https://github.com/apache/apisix/pull/13649#discussion_r3719609801
##########
apisix/plugins/openid-connect.lua:
##########
@@ -488,8 +618,92 @@ local _M = {
name = plugin_name,
schema = schema,
_build_session_opts = build_session_opts,
+ _flatten_openidc_options = flatten_openidc_options,
}
+-- lua-resty-openidc rejects a JWK that lacks the members its key type needs,
+-- but only once the first authorization request builds the thumbprint, which
+-- surfaces as a 500 per request instead of a rejected configuration.
+local function check_dpop_key(dpop)
+ local jwk = dpop and dpop.public_jwk
+ if not jwk then
+ return true
+ end
+
+ local required = dpop_jwk_required_members[jwk.kty]
+ if not required then
+ return false, "property \"dpop.public_jwk\" validation failed: kty \""
+ .. tostring(jwk.kty) .. "\" is not supported"
+ end
+
+ for _, member in ipairs(required) do
+ if jwk[member] == nil then
Review Comment:
The presence check still accepts EC JWK values that are not valid for ES256.
For example, `{kty = "EC", crv = "P-384", x = "x", y = "y"}` passes
`check_schema`, as do non-string coordinates such as `x = 1`; ES256 requires
P-256, so the emitted proof is not a valid ES256 proof. Please require `crv ==
"P-256"` for ES256 and non-empty string values for the key-type-specific
members (`x`/`y`, and `e`/`n` for RSA), with regression cases for P-384 and
wrong member types.
##########
apisix/plugins/openid-connect.lua:
##########
@@ -304,6 +354,70 @@ local schema = {
type = "boolean",
default = false
},
+ par = {
+ description = "Pushed Authorization Requests (PAR) configuration.",
+ type = "object",
+ properties = {
+ enabled = {
+ description = "When true, use Pushed Authorization
Requests (PAR).",
+ type = "boolean",
+ default = false,
+ },
+ endpoint = {
+ description = "URL of the Pushed Authorization Requests
endpoint.",
+ type = "string",
+ },
+ endpoint_auth_method = {
+ description = "Authentication method for the PAR
endpoint.",
+ type = "string",
Review Comment:
`endpoint_auth_method` still accepts values that lua-resty-openidc rejects
on the first PAR request. I reproduced `par.enabled = true` with
`endpoint_auth_method = "private_key_jwt"` and no `client_rsa_private_key`: the
Admin API accepts it, then the route returns 500 (`... is not supported`). An
unknown method follows the same path, and `client_secret_jwt` also passes
without `client_secret` when PKCE makes the secret optional. Please restrict
this field to the four methods supported by the library and, when PAR is
enabled, require `client_rsa_private_key` or `client_secret` for the effective
PAR method (the PAR override or the token-method fallback), with runtime
regressions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
