search

jfrog / setup-jfrog-cli

Set up JFrog CLI in your GitHub Actions workflow
Apache License 2.0
241 stars 73 forks source link

using this action with OIDC auth mechanism produces refreshable token #138

Open StephenWithPH opened 3 months ago

StephenWithPH commented 3 months ago

Describe the bug

Using this action per https://jfrog.com/blog/secure-access-development-jfrog-github-oidc/ results in a refreshable token being generated.

Current behavior

See above.

Reproduction steps

Use this action:

name: 'sample'
on: 'push'
permissions:
  id-token: 'write'
jobs:
  sample:
    runs-on: 'ubuntu-latest'
    steps:
      - uses: 'jfrog/setup-jfrog-cli@v4'
        env:
          JF_URL: '<JFrog Platform URL>'
        with:
          oidc-audience: 'jfrog-github' # magic strings that must align with JFrog GitHub OIDC integration
          oidc-provider-name: 'github' # magic strings that must align with JFrog GitHub OIDC integration

After, query access tokens via REST api or view them in web UI and see that the token issued for this job is refreshable.

Expected behavior

A non-refreshable token to be issued for this action which honors the configuration (including time to expiry) for the identity mapping that this action resolved to.

Setup JFrog CLI version

'jfrog/setup-jfrog-cli@v4' (SHA:d82fe26823e1f25529250895d5673f65b02af085)

JFrog CLI version

2.53.2

Workflow operating system type and version

Ubuntu 22.04.4 (runner version: '2.314.1')

JFrog Artifactory version (if relevant)

SaaS

JFrog Xray version (if relevant)

SaaS

yahavi commented 2 months ago

@StephenWithPH Thanks for reporting this issue. We are looking into it and will keep you posted.

yahavi commented 1 month ago

@StephenWithPH This fix should be available starting from Artifactory 7.87.1.

StephenWithPH commented 1 month ago

@yahavi ...

Unfortunately, this is now very hard to verify. I'm aware of changes to JFrog's API (https://jfrog.com/help/r/jfrog-rest-apis/get-tokens?page=40) such that GET /access/api/v1/tokens no longer returns any short-lived tokens. Thus, the tokens generated via OIDC have stopped showing up at all. This is the same as in the web UI.

Therefore, I can't easily verify whether or not the OIDC-generated tokens are refreshable or not.