Audience key in JWTs #733
Merged
Audience key in JWTs #733
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
greenape
added
enhancement
Codecov Report
@@ Coverage Diff @@
## master #733 +/- ##
==========================================
+ Coverage 93.74% 93.78% +0.03%
==========================================
Files 130 130
Lines 6473 6514 +41
Branches 683 685 +2
==========================================
+ Hits 6068 6109 +41
Misses 283 283
Partials 122 122
Continue to review full report at Codecov.
|
Looks like supplying it as a fixture mucks up pytest's fixture resolution
…nerators stay in sync
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
Co-Authored-By: maxalbert <maxalbert@users.noreply.github.com>
maxalbert
reviewed
May 9, 2019
Co-Authored-By: maxalbert <maxalbert@users.noreply.github.com>
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
| """ | ||
| private_key, public_key = generate_keypair() | ||
| rsa_private_key = load_private_key(private_key.decode()) | ||
| assert private_key == rsa_private_key.private_bytes( |
There was a problem hiding this comment.
Isn't this simply duplicating the implementation? Still good to have the test, I just wonder whether there is an independent way of testing it (e.g. to encrypt & decrypt a small sample message and test that we get the original result?) But if not this is probably the easiest way to test things.
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
| identity_claim_key="identity", | ||
| user_claims_key="user_claims", | ||
| json_encoder=JSONEncoder, | ||
| audience=server.name, |
There was a problem hiding this comment.
Forgot to change this to flowapi_identifier?
Co-Authored-By: maxalbert <maxalbert@users.noreply.github.com>
maxalbert
reviewed
May 9, 2019
maxalbert
reviewed
May 9, 2019
Co-Authored-By: maxalbert <maximilian.albert@gmail.com>
Co-Authored-By: maxalbert <maximilian.albert@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #727
I have:
Description
This adds an audience key to the JWTs (required to use public key signing for the link between flowauth and flowapi while not allowing tokens to be used for different servers than intended).
The audience key is the name of the server, so when adding a server in FlowAuth, this will now need to match the
FLOWAPI_IDENTIFIERenv var passed into the flowapi container.