Skip to content

feat: set api url from jwt audience claim #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
cmars wants to merge 2 commits into from
Closed

feat: set api url from jwt audience claim #258

cmars wants to merge 2 commits into from

Conversation

@cmars
Copy link
Contributor

@cmars cmars commented Oct 7, 2024 •
edited
Loading

Snyk's OAuth implementation is capable of indicating the environment which the user is authenticated into and authorized to access.

This is specified in the audience JWT claim ("aud"). Snyk's implementation of this claim contains an array of strings, per RFC 7519.

If set and non-empty, the first audience URL is taken as the default API URL that the client should use, unless the endpoint was specifically configured.

  • TODO: validate w/IDE team
  • TODO: validate w/auth folks, work out env switching rabbit holes

@cmars cmars force-pushed the feat/set-api-url-jwt-claim-aud branch from 8bdc0ae to bcdde41 Compare October 7, 2024 19:20
PeterSchafer
PeterSchafer reviewed Oct 8, 2024
View reviewed changes
@cmars cmars force-pushed the feat/set-api-url-jwt-claim-aud branch 3 times, most recently from 5f18602 to 869131b Compare October 8, 2024 16:27
@PeterSchafer
Copy link
Contributor

PeterSchafer commented Oct 8, 2024

Very Nice!!!

@cmars cmars force-pushed the feat/set-api-url-jwt-claim-aud branch 3 times, most recently from f377430 to 5661185 Compare October 8, 2024 17:37
@cmars cmars mentioned this pull request Oct 9, 2024
Merged
Casey Marshall added 2 commits November 27, 2024 21:47
@thisislawatts
feat: set api url from jwt audience claim
4909e35 
Snyk's OAuth implementation is capable of indicating the environment
which the user is authenticated into and authorized to access.

This is specified in the audience JWT claim ("aud"). Snyk's
implementation of this claim contains an array of strings, per RFC 7519.

If set and non-empty, the first audience URL is taken as the default API
URL that the client should use, unless the endpoint was specifically
configured.
@thisislawatts
chore: ignore test jwt in secret scanner
8bbfb7d 
It's a test JWT created on jwt.io for testing the parsing of claims
and cannot be used as a valid authorization anywhere.
@thisislawatts thisislawatts force-pushed the feat/set-api-url-jwt-claim-aud branch from 5661185 to 8bbfb7d Compare November 27, 2024 20:47
@thisislawatts
Copy link
Member

thisislawatts commented Nov 27, 2024 •
edited
Loading

Given the scenario that an API_URL has already been set, perhaps in error. If we get a new endpoint in the auth_token we should respect the aud claim and remove/unset the API_URL configuration so it can instead be loaded from the auth.CONFIG_KEY_OAUTH_TOKEN by the default Func handler.

https://github.com/snyk/go-application-framework/blob/main/pkg/auth/oauth2authenticator.go#L245-L253

func (o *oAuth2Authenticator) persistToken(token *oauth2.Token) error {
	tokenstring, err := json.Marshal(token)
	if err != nil {
		return err
	}
	o.config.Set(CONFIG_KEY_OAUTH_TOKEN, string(tokenstring))
	o.token = token
	return nil
}

@thisislawatts
Copy link
Member

thisislawatts commented Nov 28, 2024

Closing to continue work on feature branch feat/redirect-with-instance-param

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PeterSchafer PeterSchafer PeterSchafer left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cmars @PeterSchafer @thisislawatts