From 7a4f51a808d7ec36ae7242fd7634af4eaf7d6629 Mon Sep 17 00:00:00 2001 From: sam-burrell Date: Thu, 25 Apr 2024 17:08:45 +0100 Subject: [PATCH] Added ability to specifiy a cookieSuffix Signed-off-by: sam-burrell --- api/v1alpha1/oidc_types.go | 5 +++++ .../generated/gateway.envoyproxy.io_securitypolicies.yaml | 6 ++++++ internal/gatewayapi/securitypolicy.go | 7 ++++++- site/content/en/latest/api/extension_types.md | 1 + 4 files changed, 18 insertions(+), 1 deletion(-) diff --git a/api/v1alpha1/oidc_types.go b/api/v1alpha1/oidc_types.go index ecce7957627..00a6e485e2c 100644 --- a/api/v1alpha1/oidc_types.go +++ b/api/v1alpha1/oidc_types.go @@ -30,6 +30,11 @@ type OIDC struct { // +kubebuilder:validation:Required ClientSecret gwapiv1b1.SecretObjectReference `json:"clientSecret"` + // The optional cookie suffix to be added to Bearer and IdToken cookies in the + // [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest). + // If not specified, uses a randomly generated suffix + CookieSuffix *string `json:"cookieSuffix,omitempty"` + // The OIDC scopes to be used in the // [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest). // The "openid" scope is always added to the list of scopes if not already diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml index 2758a9c2524..53e03bdca94 100644 --- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml +++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml @@ -618,6 +618,12 @@ spec: required: - name type: object + cookieSuffix: + description: |- + The optional cookie suffix to be added to Bearer and IdToken cookies in the + [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest). + If not specified, uses a randomly generated suffix + type: string logoutPath: description: |- The path to log a user out, clearing their credential cookies. diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go index f03e46590db..ce529dda9af 100644 --- a/internal/gatewayapi/securitypolicy.go +++ b/internal/gatewayapi/securitypolicy.go @@ -588,8 +588,13 @@ func (t *Translator) buildOIDC( logoutPath = *oidc.LogoutPath } - // Generate a unique cookie suffix for oauth filters + // Generate a unique cookie suffix for oauth filters if CookieSuffix is not provided + // This is to avoid cookie name collision when multiple security policies are applied + // to the same route. suffix := utils.Digest32(string(policy.UID)) + if oidc.CookieSuffix != nil { + suffix = *oidc.CookieSuffix + } // Get the HMAC secret // HMAC secret is generated by the CertGen job and stored in a secret diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 2b259ff865d..fb39826488e 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -2080,6 +2080,7 @@ _Appears in:_ | `provider` | _[OIDCProvider](#oidcprovider)_ | true | The OIDC Provider configuration. | | `clientID` | _string_ | true | The client ID to be used in the OIDC
[Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest). | | `clientSecret` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.SecretObjectReference)_ | true | The Kubernetes secret which contains the OIDC client secret to be used in the
[Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).

This is an Opaque secret. The client secret should be stored in the key
"client-secret". | +| `cookieSuffix` | _string_ | false | The optional cookie suffix to be added to Bearer and IdToken cookies in the [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest). If not specified, uses a randomly generated suffix | | `scopes` | _string array_ | false | The OIDC scopes to be used in the
[Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
The "openid" scope is always added to the list of scopes if not already
specified. | | `resources` | _string array_ | false | The OIDC resources to be used in the
[Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest). | | `redirectURL` | _string_ | true | The redirect URL to be used in the OIDC
[Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
If not specified, uses the default redirect URI "%REQ(x-forwarded-proto)%://%REQ(:authority)%/oauth2/callback" |