Open aramase opened 9 months ago
Some previous links:
https://github.com/coreos/go-oidc/issues/334#issuecomment-1122913378 https://github.com/coreos/go-oidc/issues/355#issuecomment-1287435457
Kubernetes should be able to do all of this without changes to go-oidc using the SkipClientIDCheck. So I don't believe we're blocking your KEP.
If we're going to add an API here, I'm still not clear on:
For now, is this a dup of https://github.com/coreos/go-oidc/issues/355?
Thanks for the response!
Kubernetes should be able to do all of this without changes to go-oidc using the SkipClientIDCheck. So I don't believe we're blocking your KEP.
Right, this change is not blocking the KEP. SkipClientIDCheck
is what I've been looking at but wanted to propose the change here to see if it's a valid use-case.
What kind of scenarios this is relevant, and what providers support this
I'm trying to find more information on this.
For now, is this a dup of https://github.com/coreos/go-oidc/issues/355?
I'm not sure if this is a dup of #355, because we aren't changing anything related to azp claims?
We use
github.com/coreos/go-oidc
. IDTokenVerifier in the Kubernetes authenticator package.I'm working on supporting Structured Authentication Configuration in Kubernetes. As part of this feature, we're going to support configuring multiple client IDs in the JWT authenticator.
For this, I would like to propose a change in this package to support checking for multiple client IDs against the audiences as part of
Verify
.Here is the diff
@ericchiang I've implemented this change in a branch and would like to get your feedback. Is this change you would be willing to review and merge? For context, without this change, we would need to perform the audience match in the authenticator after
Verify
.