[jira] [Resolved] (KNOX-3434) Token validation for oidc trusted issuers skips typ validation so k8s projected tokens can be used

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3434?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar resolved KNOX-3434.
---------------------------------
    Fix Version/s: 3.1.0
       Resolution: Fixed

> Token validation for oidc trusted issuers skips typ validation so k8s projected tokens can be used
> --------------------------------------------------------------------------------------------------
>
>                 Key: KNOX-3434
>                 URL: https://issues.apache.org/jira/browse/KNOX-3434
>             Project: Apache Knox
>          Issue Type: Task
>          Components: JWT
>            Reporter: Harrison Sheinblatt
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> Currently all tokens are validated with a commonly configured type verifier. k8s projected tokens do not include a typ header, and so would fail verification. When token verification uses a TrustedOidcIssuer, registered as an external issuer, then skip typ validation. This will allow k8s projected tokens to be verified.
> In the future, if other types of external issuers are to be registered, the schema for the trusted issuer can be extended to include a flag controlling if typ verification is to be skipped, or optionally which verifier to use. But for now, this avoids having to dynamically update the list of issuers for which to skip type verification separately from the trusted oidc issuer registration.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)