AlinsRan commented on code in PR #13649:
URL: https://github.com/apache/apisix/pull/13649#discussion_r3718313378
##########
apisix/plugins/openid-connect.lua:
##########
@@ -383,6 +466,22 @@ local schema = {
type = "integer",
default = 60
},
+ -- resty.jwt signs the client assertion and raises an uncaught Lua
+ -- error for an algorithm it cannot handle, so an unconstrained value
+ -- would surface as a 500 per request instead of a rejected config.
+ -- lua-resty-openidc depends on lua-resty-jwt, which supports more
+ -- algorithms, but it installs the same resty/jwt.lua as the
+ -- api7-lua-resty-jwt this rockspec pins and luarocks leaves the
+ -- pinned one in place either way, so the effective set is this one.
+ client_jwt_assertion_alg = {
+ description = "Signing algorithm for the client assertion JWT.",
+ type = "string",
+ enum = {"HS256", "HS512", "RS256", "RS512", "ES256", "ES512"}
Review Comment:
Confirmed and fixed in fe0e0c6 — both combinations passed `check_schema`,
and the library then returns the cannot-use-symmetric / cannot-use-asymmetric
error as a 500.
`check_schema` now checks the algorithm family against every endpoint that
can select JWT auth: `token_endpoint_auth_method`,
`introspection_endpoint_auth_method` and `par.endpoint_auth_method`.
On the cross-endpoint case, one correction to the suggestion. Selecting both
families is only a conflict when `client_jwt_assertion_alg` is actually
configured — with it unset the library computes the default per call site:
```lua
local alg = opts.client_jwt_assertion_alg or (auth == "private_key_jwt" and
"RS256" or "HS256")
```
so `private_key_jwt` for the token endpoint and `client_secret_jwt` for
introspection is a valid configuration and gets `RS256` and `HS256`
respectively. Rejecting it unconditionally would break a config that works
today, so the conflict check is gated on the algorithm being set. TEST 71
covers the rejection, TEST 72 pins that the unset case stays valid.
```
property "client_jwt_assertion_alg" "HS256" is symmetric and cannot be used
with the private_key_jwt selected by "token_endpoint_auth_method"
property "client_jwt_assertion_alg" is a single algorithm, but
"token_endpoint_auth_method" selects private_key_jwt and
"introspection_endpoint_auth_method" selects client_secret_jwt
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
