Added configurable allow for JWK url as issuer #103
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
on K8s the issuer and audience is same as well as JWK. Allow conditionally to allow another issuer from k8s if multi tenancy use-case is needed (multiple realms as tenants, one k8s SA as client to access those realms).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Consider scenario:
Solution:
On K8s the issuer and audience is same as well as JWK.
Conditionally to allow another audience from k8s if specified in client attribute. Also risk is minimal as what we are doing is basically token exchange of k8s token (only auth than droped) and client from keycloak is than used (audience is correct at that moment).
FYI
Current main is broken since update to 26.4.0 of keycloak, needs a bit of refactor as Validate token vs ClientAuthenticator changed in keycloak, this MR is for 26.3.* versions