fix: enable JWT audience verification #459
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This patch updates the JWT generation/verification code used today for authentication and attestation (robot-accounts) to generate and verify respective custom
audiencevalues.The reason for this change is in preparation for #453, where we'll be creating additional JWT tokens that are meant to be distinct from the existing authentication ones.
The changes are as follows
Temporary authentication tokens
The tokens result of
chainloop auth loginnow have the audienceuser-auth.chainloop, existing tokens will fail to validate, but that's ok since they have 24 hours max validity.Robot-accounts
These tokens now have
aud=attestations.chainloopbut during verification we still support its previous value. This is to maintain compatibility with robot-accounts that are already in place. New ones will have the rightaudience