Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feat] PIP-257: Add AuthenticationProviderOpenID #19849

Merged
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
60df13a
[feat] PIP-257: Add AuthenticationProviderOpenID
michaeljmarshall Mar 17, 2023
c7474fa
Improve imports in pom.xml
michaeljmarshall Mar 17, 2023
af7e3ae
Refactor packaging: move under oidc
michaeljmarshall Mar 17, 2023
518aa08
Reorder imports
michaeljmarshall Mar 17, 2023
e93b903
Upgrade auth0 dependencies; improve claims validation
michaeljmarshall Mar 17, 2023
dcb6008
Remove some versions in child pom.xml
michaeljmarshall Mar 17, 2023
6f76bbd
Use async http client to get JWKS
michaeljmarshall Mar 20, 2023
c4bdd59
Require JWT has OIDC's required claims
michaeljmarshall Mar 20, 2023
83a512a
Remove audit logging; it belongs in framework
michaeljmarshall Mar 20, 2023
08d971a
Cleanup failure metrics
michaeljmarshall Mar 20, 2023
dd96e17
Cleanup pom.xml
michaeljmarshall Mar 20, 2023
1b46eb4
Cleanup Javadocs
michaeljmarshall Mar 20, 2023
6ea2331
Add Auth0 to license.bin.txt
michaeljmarshall Mar 20, 2023
64c8c15
Close the httpClient
michaeljmarshall Mar 28, 2023
fdf6f36
Normalize URL when getting openid-configuration
michaeljmarshall Mar 29, 2023
3d96294
Cover invalid audience claim in integration tests
michaeljmarshall Mar 29, 2023
941a9f5
Improve failure scenario coverage in integration tests
michaeljmarshall Mar 29, 2023
bc4e421
Add support for k8s Api Server
michaeljmarshall Mar 29, 2023
dadbf4c
Support a custom trust store for issuers http client
michaeljmarshall Mar 29, 2023
7340b0e
Improve config name for openIDRequireIssuersUseHttps
michaeljmarshall Mar 29, 2023
932dcd7
Add k8s discover mode to support EKS, AKS, GKE
michaeljmarshall Mar 29, 2023
5eccb86
Make discovery mode more abstract to enable future additions
michaeljmarshall Mar 29, 2023
ecb5566
Remove test dependency on hard coded port
michaeljmarshall Apr 7, 2023
fa93b4c
Refactor to support refreshAfterWrite
michaeljmarshall Apr 7, 2023
a94315b
Remove unused import
michaeljmarshall Apr 7, 2023
f4b18a0
Exclude io.prometheus:simpdleclient_httpserver from k8s client
michaeljmarshall Apr 8, 2023
511b27a
Remove trailing / from issuer per OIDC Discovery Section 4.1
michaeljmarshall Apr 10, 2023
860ceff
Require token has role claim
michaeljmarshall Apr 10, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Cleanup Javadocs
  • Loading branch information
michaeljmarshall committed Mar 20, 2023
commit 1b46eb43b8de5fdb6109e9422063692567d5047c
Original file line number Diff line number Diff line change
Expand Up @@ -159,17 +159,12 @@ public String getAuthMethodName() {
}

/**
* Authenticate the parameterized {@link AuthenticationDataSource}.
*
* If the {@link AuthenticationProviderToken} is enabled and the JWT does not have an Issuer ("iss") claim,
* this class will use the {@link AuthenticationProviderToken} to verify/authenticate the token. See the
* documentation for {@link AuthenticationProviderToken} regarding configuration.
*
* Otherwise, this class will verify/authenticate the token by retrieving the Public key from allow listed issuers.
* Authenticate the parameterized {@link AuthenticationDataSource} by verifying the issuer is an allowed issuer,
* then retrieving the JWKS URI from the issuer, then retrieving the Public key from the JWKS URI, and finally
* verifying the JWT signature and claims.
*
* @param authData - the authData passed by the Pulsar Broker containing the token.
* @return the role, if the JWT is authenticated
* @throws AuthenticationException if the JWT is invalid
* @return the role, if the JWT is authenticated, otherwise a failed future.
*/
@Override
public CompletableFuture<String> authenticateAsync(AuthenticationDataSource authData) {
Expand Down Expand Up @@ -315,22 +310,8 @@ public AuthenticationState newAuthState(AuthData authData, SocketAddress remoteA
return new AuthenticationStateOpenID(this, remoteAddress, sslSession);
}

/**
* Closes this stream and releases any system resources associated
* with it. If the stream is already closed then invoking this
* method has no effect.
*
* <p> As noted in {@link AutoCloseable#close()}, cases where the
* close may fail require careful attention. It is strongly advised
* to relinquish the underlying resources and to internally
* <em>mark</em> the {@code Closeable} as closed, prior to throwing
* the {@code IOException}.
*
* @throws IOException if an I/O error occurs
*/
@Override
public void close() throws IOException {
// noop
}

/**
Expand Down