[
https://issues.apache.org/jira/browse/KNOX-3498?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandeep More updated KNOX-3498:
-------------------------------
Description:
+{*}UPDATE{*}: This is NOT due to BouncyCastle FIPS but because of the Nimbus
library, see KNOX-3519 for details+
A trusted OIDC issuer whose discovery url has IP (used in`jwks_uri`) breaks
with BouncyCastle FIPS, the failure looks like a missing CA which is
misleading.
For KnoxIDF, registering a trusted OIDC issuer whose discovery document
advertises `jwks_uri` as an IP makes token exchange fail, and the reported
error is looks similar to trust-store misconfiguration. Example is in k8s
: kube-apiserver advertises an IP by default, e.g.
"jwks_uri": "https://10.83.4.208:6443/openid/v1/jwks";
*Workaround:*
1. Knox config:
Move the issuer onto the static verification route, which accepts an explicit
JWKS URL list, and give it the hostname form of the endpoint:
<param><name>jwt.expected.issuer</name>
<value>KNOXSSO,[https://kubernetes.default.svc.cluster.local|https://kubernetes.default.svc.cluster.local/]</value></param>
<param><name>knox.token.jwks.urls</name>
<value>[https://knox.example.com/gateway/knox-token/knoxtoken/api/v1/jwks.json],
[https://kubernetes.default.svc.cluster.local/openid/v1/jwks]</value></param>
2. K8S Config
Alternatively fix it at the source with kube-apiserver
`--service-account-jwks-uri=[https://kubernetes.default.svc.cluster.local/openid/v1/jwks]`.
was:
A trusted OIDC issuer whose discovery url has IP (used in`jwks_uri`) breaks
with BouncyCastle FIPS, the failure looks like a missing CA which is
misleading.
For KnoxIDF, registering a trusted OIDC issuer whose discovery document
advertises `jwks_uri` as an IP makes token exchange fail, and the reported
error is looks similar to trust-store misconfiguration. Example is in k8s
: kube-apiserver advertises an IP by default, e.g.
"jwks_uri": "https://10.83.4.208:6443/openid/v1/jwks";
*Workaround:*
1. Knox config:
Move the issuer onto the static verification route, which accepts an explicit
JWKS URL list, and give it the hostname form of the endpoint:
<param><name>jwt.expected.issuer</name>
<value>KNOXSSO,https://kubernetes.default.svc.cluster.local</value></param>
<param><name>knox.token.jwks.urls</name>
<value>https://knox.example.com/gateway/knox-token/knoxtoken/api/v1/jwks.json,
https://kubernetes.default.svc.cluster.local/openid/v1/jwks</value></param>
2. K8S Config
Alternatively fix it at the source with kube-apiserver
`--service-account-jwks-uri=https://kubernetes.default.svc.cluster.local/openid/v1/jwks`.
> OIDC issuer discovery url with IP breaks when FIPS enabled.
> -----------------------------------------------------------
>
> Key: KNOX-3498
> URL: https://issues.apache.org/jira/browse/KNOX-3498
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandeep More
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> +{*}UPDATE{*}: This is NOT due to BouncyCastle FIPS but because of the Nimbus
> library, see KNOX-3519 for details+
> A trusted OIDC issuer whose discovery url has IP (used in`jwks_uri`) breaks
> with BouncyCastle FIPS, the failure looks like a missing CA which is
> misleading.
>
> For KnoxIDF, registering a trusted OIDC issuer whose discovery document
> advertises `jwks_uri` as an IP makes token exchange fail, and the reported
> error is looks similar to trust-store misconfiguration. Example is in k8s
> : kube-apiserver advertises an IP by default, e.g.
> "jwks_uri": "https://10.83.4.208:6443/openid/v1/jwks";
>
> *Workaround:*
> 1. Knox config:
> Move the issuer onto the static verification route, which accepts an explicit
> JWKS URL list, and give it the hostname form of the endpoint:
> <param><name>jwt.expected.issuer</name>
>
> <value>KNOXSSO,[https://kubernetes.default.svc.cluster.local|https://kubernetes.default.svc.cluster.local/]</value></param>
> <param><name>knox.token.jwks.urls</name>
>
> <value>[https://knox.example.com/gateway/knox-token/knoxtoken/api/v1/jwks.json],
>
> [https://kubernetes.default.svc.cluster.local/openid/v1/jwks]</value></param>
> 2. K8S Config
> Alternatively fix it at the source with kube-apiserver
> `--service-account-jwks-uri=[https://kubernetes.default.svc.cluster.local/openid/v1/jwks]`.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
