search

spiffe / spire

The SPIFFE Runtime Environment
https://spiffe.io
Apache License 2.0
1.8k stars 475 forks source link

Make the JWT issuer configurable in the OIDC Discovery Provider #5480

Open jer8me opened 2 months ago

jer8me commented 2 months ago

The issuer returned by the OIDC Discovery Provider is currently dynamically built based on the request host: https://github.com/spiffe/spire/blob/v1.10.3/support/oidc-discovery-provider/handler.go#L66

There are a couple of issues with this approach:

  1. Only host-based issuers are supported. We cannot use a path component to support multiple issuers per host. For instance:

  2. If the OIDC Discovery Provider service is reachable via more than one host, it will return a different issuer based on the host used for the request. This does not really make sense from an OIDC point of view because a SPIRE server is configured with exactly one jwt_issuer. The issuer returned by the OIDC Discovery Provider should match the one configured in the server.

azdagron commented 1 month ago

The issuer returned by the OIDC Discovery Provider should match the one configured in the server.

This is the biggest sticking point for me on why this should be configurable.

We'd accept a change here.

aluthra-37 commented 1 month ago

I talked to @jer8me about this issue. We were thinking that we could add an optional configuration item in the OIDC provider to set the jwt_issuer. If missing, we would keep the existing behavior but if set, we could use it as the jwt_issuer, bypassing the dynamic logic. If this sounds good, could you please assign this issue to me

azdagron commented 1 month ago

Sounds great. Thanks @aluthra-37 .

kfox1111 commented 2 weeks ago

@aluthra-37, I have a need to resolve this too. Do you have time to work on this soon? If not, would you mind if I write up a pr for it?

aluthra-37 commented 2 weeks ago

Hey @kfox1111. I'm currently working on a PR for this. I should have one out soon