-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for "meta issuers". #223
Conversation
a37daec
to
04aeea7
Compare
These are separate from the fixed OIDC issuers, and they represent templates for *classes* of OIDC endpoints that we want to support, e.g. for EKS: ``` https://oidc.eks.*.amazonaws.com/id/* ``` The `*` character here will be used to match `[a-zA-Z0-9_-]+`, so no host or path delimiting characters are allowed to prevent attacks like: ``` https://oidc.eks.mattmoor.io/pwned.amazonaws.com/id/does-not-matter ``` We do NOT maintain OIDC verifiers for all of the possible endpoints, but we do keep an LRU cache to avoid the expensive discovery process on each request. Related: sigstore#212 Signed-off-by: Matt Moore <[email protected]>
Let's hold this for @bobcallaway to take a look too, but I like it. |
I wanna get this fix in, and then I'll rebase this: #224 |
I'm thinking about even making the config use |
} | ||
|
||
// Look in the LRU cache for a verifier | ||
untyped, ok := fc.lru.Get(issuerURL) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we're covered by the OIDC lib in case the keys rotate; just noting this in case for some reason it doesn't.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe the OIDC lib internally handles caching/rotating for a particular discovery endpoint, but since each of these "meta" things are N endpoints (where N is possibly O(XXX,XXX)!) I wanted some sort of eviction strategy.
These are separate from the fixed OIDC issuers, and they represent templates for classes of OIDC endpoints that we want to support, e.g. for EKS:
The
*
character here will be used to match[a-zA-Z0-9_-]+
, so no host or path delimiting characters are allowed to prevent attacks like:We do NOT maintain OIDC verifiers for all of the possible endpoints, but we do keep an LRU cache to avoid the expensive discovery process on each request.
Related: #212
Signed-off-by: Matt Moore [email protected]
WIP until #222 lands, and I may add the GKE/EKS stuff to this change.
Release Note