nic-6443 opened a new pull request, #13829: URL: https://github.com/apache/apisix/pull/13829
### Description Three checks the `openid-connect` config asks for don't run on some paths, so a request the operator meant to reject gets through. They're all in the same plugin, so I put them in one PR. **`claim_validator.audience.match_with_client_id` is skipped when `aud` is absent.** The comparison is guarded by `audience_value ~= nil`, and `audience.required` defaults to false and isn't implied by `match_with_client_id`, so a validly signed token that simply omits `aud` is accepted while one with the wrong `aud` is rejected. A token without an audience can't match the client id, so it's now treated like a missing required audience. **Issuer validation is skipped when the discovery document can't be fetched.** With no explicit `valid_issuers`, the trusted issuer comes from discovery; a fetch error only logs a warning and `bearer_jwt_verify` then runs with `opts.valid_issuers` unset, i.e. with no issuer constraint. In `public_key`/`use_jwks` mode the signature check is offline, so while discovery is down a token from any issuer signed with a key APISIX trusts is accepted. Now the token is rejected while no trusted issuer is known — an explicit `claim_validator.issuer.valid_issuers` keeps working without touching discovery. **`required_scopes` isn't enforced in the authorization code flow.** `required_scopes_present()` is only called inside the `bearer_only or introspection_endpoint or public_key or use_jwks` branch. A route protected by the interactive session flow goes through `openidc.authenticate()` and never reaches it, so every authenticated user passes regardless of their scopes. The check now runs on that path too, reading the granted scopes from the `scope` claim of the access token (a JWT for the providers that support scope-based authorization), falling back to the ID token claims. A session whose granted scopes can't be determined is rejected rather than allowed unchecked — the operator asked for scope-based authorization, and silently skipping it is the bug being fixed here. Tests: `t/plugin/openid-connect-claim-validation.t` covers the audience and issuer paths standalone (self-signed JWT + `public_key`, no ID provider needed), `t/plugin/openid-connect-required-scopes.t` covers the session flow against Keycloak. Both fail on master and pass with this change. Behaviour change to note for the release notes: configurations that rely on any of the three gaps above will now see 401/403 where the request used to pass. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) — see the behaviour change noted above -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
