-
Notifications
You must be signed in to change notification settings - Fork 134
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Correct SPIFFE trust domain checking #588
Conversation
Codecov Report
@@ Coverage Diff @@
## main #588 +/- ##
==========================================
+ Coverage 45.90% 46.30% +0.39%
==========================================
Files 21 21
Lines 1501 1501
==========================================
+ Hits 689 695 +6
+ Misses 740 736 -4
+ Partials 72 70 -2
Continue to review full report at Codecov.
|
2973812
to
f96c3a8
Compare
The failing test is because you will need to update |
f96c3a8
to
2b028e9
Compare
SPIFFE issuers must configure a trust domain. We no longer assume that the the trust domain has some implicit relationship with the OIDC issuer domain. Tokens with a mismatch in trust domain are rejected. Signed-off-by: Nathan Smith <[email protected]>
2b028e9
to
5d9a4d1
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good!
Can you update the PR summary? |
Summary
SPIFFE issuers must configure a trust domain. We no longer assume that
the the trust domain has some implicit relationship with the OIDC issuer
domain. Tokens with a mismatch in trust domain are rejected.
Release Note