Implement distributed authentication trust via TrustedIssuers#248
Implement distributed authentication trust via TrustedIssuers#248
Conversation
This change allows multiple tlsproxy instances to trust authentication
tokens (AUTH tokens) issued by each other. Trust is established at the
Identity Provider (IdP) level (OIDC, SAML, Passkey), allowing fine-grained
control over which external issuers are trusted for specific backends.
Key changes:
- Configuration: Added 'trustedIssuers' list to ConfigOIDC, ConfigSAML,
and ConfigPasskey. Each entry specifies an 'issuer' URL and a 'jwksUri'.
- TokenManager:
- Added support for managing and automatically refreshing JSON Web Key
Sets (JWKS) from trusted issuers using background goroutines.
- Added 'IssuerForKey(kid)' to dynamically identify the issuer
associated with a signing key.
- Updated 'getKey' to support public key lookup from trusted issuers.
- CookieManager:
- Updated 'validateAuthToken' to dynamically determine the token's
issuer based on its 'kid'.
- Enforces strict 'jwt.WithIssuer' and 'jwt.WithAudience' validation
using the identified issuer (AUD == ISS for Auth tokens).
- Verifies that the identified issuer is explicitly trusted by the
provider associated with the CookieManager.
- Security: Maintained strict local-only validation for ID tokens and
Authorization headers to preserve existing security boundaries.
- Documentation: Updated README.md with the new configuration options
and examples.
- Testing: Added comprehensive unit tests for the trusted issuer
validation logic in CookieManager.
Refactor trusted issuer validation and extraction logic
Extracted duplicated validation logic in Config.Check and extraction logic
in Proxy.Reconfigure into helper functions to improve maintainability and
readability.
Summary of ChangesHello @rthellend, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a significant new feature enabling distributed authentication trust across multiple tlsproxy instances. It allows proxies to validate authentication tokens issued by other configured and trusted identity providers, enhancing the system's flexibility for deployments requiring cross-instance authentication. The changes involve updates to configuration structures, token management, and cookie validation logic, ensuring secure and dynamic trust establishment. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a significant new feature: distributed authentication trust via TrustedIssuers. This allows multiple tlsproxy instances to trust authentication tokens from each other, which is a great addition for distributed setups. The implementation looks solid, with changes spanning configuration, token management, and cookie validation. The addition of background JWKS refreshing is well-handled. I've included a few suggestions to improve error message clarity and add some robustness checks. Overall, this is a well-executed feature with good test coverage.
1 participant
Description
This change allows multiple tlsproxy instances to trust authentication tokens (AUTH tokens) issued by each other. Trust is established at the Identity Provider (IdP) level (OIDC, SAML, Passkey), allowing fine-grained control over which external issuers are trusted for specific backends.
Key changes:
Refactor trusted issuer validation and extraction logic
Extracted duplicated validation logic in Config.Check and extraction logic in Proxy.Reconfigure into helper functions to improve maintainability and readability.
Type of change
How is this change tested ?