yetanalytics / lrsql

A SQL-based Learning Record Store
https://www.sqllrs.com
Apache License 2.0
91 stars 17 forks source link

[SQL-208] Proxy JWT Validation Bypass #324

Closed cliffcaseyyet closed 1 year ago

cliffcaseyyet commented 1 year ago

For VERY specific and dangerous authentication proxy systems allow the bypass of JWT signature validation via config var and simply trust claims. In order to do so 4 additional config vars are needed, one for the key of the intended username claim, one for the intended issuer claim, one for where to find role(s) and one for what role is needed to proceed.