search

coreos / go-oidc

A Go OpenID Connect client.
Apache License 2.0
1.92k stars 393 forks source link

feat: export unexpected audience error #406

Closed crenshaw-dev closed 8 months ago

crenshaw-dev commented 8 months ago

Argo CD loops over an OIDC provider's configured allowed audiences, attempting to verify each one. If verification fails, we try more providers. https://github.com/argoproj/argo-cd/blob/0b35e2f1fe27f395e6106a7466d58911c4f7ec9c/util/oidc/provider.go#L108-L120

Since we don't know exactly why token verification fails, we have no way to know whether we should short-circuit the loop. After all, if the token is invalid for some reason besides a disallowed audience, it's a waste of time trying to validate against other audiences.

Knowing that the verification failed due to an invalid audience would allow us to do two things: 1) short-circuit the loop if we encounter an error unrelated to audiences 2) log only the relevant error message rather than continuing the loop and logging an unrelated error about unmatching audiences

Yucky workaround I'm using for now: https://github.com/argoproj/argo-cd/pull/16625

crenshaw-dev commented 8 months ago

@ericchiang agreed, skipping the client ID check and then performing it in Argo CD is probably better. Thanks for the suggestion!