search

jenkinsci / oidc-provider-plugin

OpenID Connect Provider Plugin for Jenkins
https://plugins.jenkins.io/oidc-provider/
MIT License
22 stars 13 forks source link

Change `sub` from project URL to (folder-qualified) name #15

Closed jglick closed 2 years ago

jglick commented 2 years ago

https://github.com/jenkinsci/oidc-provider-plugin/issues/14#issuecomment-1212069213

Under discussion what this should ultimately be. Possibly IdTokenCredentials could just have a format field where you could insert the project URL, full name, or various claims as you preferred.

jglick commented 2 years ago

Possibly IdTokenCredentials could just have a format field

Would need to be considered carefully to make sure this does not introduce a weakness by allowing anyone to impersonate another job. I think that would not be a problem since you could only do that by creating your own credentials which would then have another issuer. Certainly safer for the subject to not be under user control.

jglick commented 2 years ago

Prefer #18.