You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues-all@impala.apache.org by "gaurav singh (Jira)" <ji...@apache.org> on 2024/03/25 15:11:00 UTC
[jira] [Commented] (IMPALA-12558) JSON Web Keys (JWK) Must Not Require the Optional alg Property
[ https://issues.apache.org/jira/browse/IMPALA-12558?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17830533#comment-17830533 ]
gaurav singh commented on IMPALA-12558:
---------------------------------------
Impala requires the 'alg' value in the jwks.json stored on the impala cluster (server side) in order to construct the {*}JWKPublicKey{*}.
{code:java}
{
"keys": [
{
"kty": "RSA",
"e": "AQAB",
"use": "sig",
"kid": "WK-ahKKYNs5PtFxMiPuMRhdjeEVlHpPkQRYs62-LjF4",
"alg": "RS256",
"n": "2nyM8JEu45EcXjnDLfM_60cWQtwBmsmKeg-ZuMTcHHAKSOkV_Q39i2RAOnv8zs7TYH_meDvlYBgdQo9hYHlx4METd3XU4mMGYoZbhp66SyUcmvcRqBhSWGRMChUyMoG9meNZT9qgT1z-47Zn9STLRa3UMVCn_Wwmp8Sk81vtfwVLb7Vec6IlGYX-KSknWX19tUhfvok0q9CdEqf3DIsuGNue8o10rRFQ_VlGaX6FD28xZPyT0ZNYs5vivvJ7h6WQIdPaaN8VpbTqiOEk8BGmYVgaMhF4O5MbFZyUUvJPAMBdulZvtHPJOxhV45IgcmIGgHWBE2Ylk2QV_3gAD9MpxQ"
}
]
}{code}
If that field is missing, then we would have to defer the JWKPublicKey creation until we receive first valid request from the client which will contain the alg field in the header (mandatory field). Example below:
{code:java}
{
"jku": "https://dw-team-env-dl-gateway.dw-team.xcu2-8y8x.dev.cldr.work/dw-team-env-dl/homepage/knoxtoken/api/v1/jwks.json",
"kid": "WK-ahKKYNs5PtFxMiPuMRhdjeEVlHpPkQRYs62-LjF4",
"typ": "JWT",
"alg": "RS256"
}{code}
Using this alg value, we can construct the JWT Public key on the server side and also store this value.
The only concern is that we are now depending on the client request for this value.
Any thoughts on this ?
> JSON Web Keys (JWK) Must Not Require the Optional alg Property
> --------------------------------------------------------------
>
> Key: IMPALA-12558
> URL: https://issues.apache.org/jira/browse/IMPALA-12558
> Project: IMPALA
> Issue Type: Bug
> Components: be, Security
> Reporter: Jason Fehr
> Assignee: gaurav singh
> Priority: Critical
> Labels: JWT, jwt, security
>
> According to the [JWK RFC|https://datatracker.ietf.org/doc/html/rfc7517#section-4.4], the "alg" property is optional on JWKs.
> Update Impala so that the "alg" property is no longer required on the JWKs.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org