oidc authentication: switch to v2 of coreos/go-oidc #58544

ericchiang · 2018-01-19T22:11:15Z

Switch to v2 of coreos/go-oidc, which uses square/go-jose to verify tokens and supports more signing algorithms.

Most of this PR removes dependencies used by the older version of github.com/coreos/go-oidc, and updates vendor files.

This PR has been tested against tokens issued by Okta, Google, and CoreOS's dex.

kube-apiserver: the OpenID Connect authenticator can now verify ID Tokens signed with JOSE algorithms other than RS256 through the --oidc-signing-algs flag.
kube-apiserver: the OpenID Connect authenticator no longer accepts tokens from the Google v3 token APIs, users must switch to the "https://www.googleapis.com/oauth2/v4/token" endpoint.

cc @rithujohn191 @liggitt
cc @kubernetes/sig-auth-pr-reviews

thockin

Godep parts look OK. ping me when LGTM'ed and I can approve.

rithujohn191

the lint check and staging-godeps check seems to have failed

rithujohn191 · 2018-01-20T00:19:06Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go

+			var groups []string
+			if err := c.unmarshalClaim(a.groupsClaim, &groups); err != nil {
+				var group string
+				if err := c.unmarshalClaim(a.groupsClaim, &group); err != nil {


A comment about why you are trying to decode it as string again as opposed to an array of strings would be helpful

Added a link to #33290

alternatively create a:

type stringOrArray []string

with a UnmarshalJSON func that does the right thing.

ericchiang · 2018-01-20T18:42:22Z

https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/58544/pull-kubernetes-unit/76002/

Failure on

k8s.io/kubernetes/vendor/k8s.io/apiextensions-apiserver/test/integration TestPatch 0.82s

/test pull-kubernetes-unit

liggitt · 2018-01-20T21:36:04Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/gen.sh

@@ -0,0 +1,27 @@
+#!/bin/bash -e


can we move this under testdata? makes it clearer it is only for test

liggitt · 2018-01-20T21:41:20Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go

+}
+
+// whilelist of signing algorithms to ensure users don't mistakenly pass something
+// goofy.


don't want to enable none? :)

I swear I remember someone accidentally using tokens with HS256.

liggitt · 2018-01-20T21:43:19Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go

-	if client := a.oidcClient.Load(); client != nil {
-		return client.(*oidc.Client), nil
-	}
+	client := &http.Client{Transport: tr, Timeout: 15 * time.Second}


this is the client used in the background to fetch discovery docs and public keys? what was the timeout before?

edit: found it. there was no timeout previously. 15 seconds sounds a little aggressive, especially for a background process.

Bumped to 30 seconds

ericchiang · 2018-01-22T19:29:03Z

/test pull-kubernetes-e2e-kops-aws

ericchiang · 2018-01-22T20:46:16Z

/test pull-kubernetes-e2e-kops-aws

edit: flaking on #58578

ericchiang · 2018-01-23T15:23:16Z

/test pull-kubernetes-e2e-kops-aws

ericchiang · 2018-01-24T00:42:05Z

/test pull-kubernetes-e2e-kops-aws

ericchiang · 2018-01-24T23:28:51Z

/test pull-kubernetes-e2e-kops-aws

ericchiang · 2018-01-25T19:45:44Z

@kubernetes/sig-auth-pr-reviews tests are green

liggitt · 2018-01-26T04:20:32Z

+	// Check issuer.
+	if t.Issuer != v.issuer {
+		// Google sometimes returns "accounts.google.com" as the issuer claim instead of
+		// the required "https://accounts.google.com". Detect this case and allow it only
+		// for Google.
+		//
+		// We will not add hooks to let other providers go off spec like this.
+		if !(v.issuer == issuerGoogleAccounts && t.Issuer == issuerGoogleAccountsNoScheme) {
+			return nil, fmt.Errorf("oidc: id token issued by a different provider, expected %q got %q", v.issuer, t.Issuer)
+		}
+	}

really?

liggitt · 2018-01-26T04:33:35Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go

+	if !ok {
+		return fmt.Errorf("claim not present")
+	}
+	return json.Unmarshal([]byte(val), v)


does this echo the value in errors? we weren't returning claim values in error messages before, just type info

It's doesn't appear to return the value: https://play.golang.org/p/Ed2vi-1gDEK

I can add a test to make sure that behavior doesn't change in future releases of Go.

Test added.

liggitt · 2018-01-26T04:35:01Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go

-		return nil, false, err
-	}
-	claims, err := jwt.Claims()
+	idToken, err := verifier.Verify(ctx, token)


can be a follow-up, but might be good to consider doing something similar to #58791 to avoid noise in logs when this is combined with other token auth methods

liggitt · 2018-01-26T04:55:11Z

a couple questions, LGTM overall. would like a second review on the authorize path. @tallclair can you review or pick a delegate?

thockin · 2018-02-06T01:01:57Z

I have no context on this - please assign to me if you need some approval.

liggitt · 2018-02-10T17:27:27Z

/lgtm

would like a second from another @kubernetes/sig-auth-pr-reviews reviewer, then can get top-level approval for godep change

mikedanese

/lgtm

mikedanese · 2018-02-16T18:12:53Z

staging/src/k8s.io/apiserver/plugin/pkg/authenticator/token/oidc/oidc.go

+	})
+}
+
+// whilelist of signing algorithms to ensure users don't mistakenly pass something


typo: whitelist

…c46b

mikedanese · 2018-02-16T19:00:59Z

/lgtm

ericchiang · 2018-02-16T19:52:14Z

/assign @thockin

For final approval

smarterclayton · 2018-02-21T15:20:30Z

/approve

for godep

k8s-ci-robot · 2018-02-21T15:20:40Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ericchiang, liggitt, mikedanese, smarterclayton

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~Godeps/OWNERS~~ [smarterclayton]
~~cmd/kube-apiserver/OWNERS~~ [liggitt,mikedanese,smarterclayton]
~~hack/OWNERS~~ [liggitt,smarterclayton]
~~pkg/kubeapiserver/OWNERS~~ [liggitt,smarterclayton]
~~staging/OWNERS~~ [smarterclayton]
~~vendor/OWNERS~~ [smarterclayton]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-github-robot · 2018-02-21T16:04:21Z

/test all [submit-queue is verifying that this PR is safe to merge]

k8s-github-robot · 2018-02-21T17:07:22Z

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here.

k8s-github-robot assigned thockin and dchen1107 Jan 19, 2018

thockin reviewed Jan 19, 2018

View reviewed changes

ericchiang force-pushed the oidc-v2 branch 2 times, most recently from 3e0afec to 8eeefd2 Compare January 19, 2018 22:55

rithujohn191 reviewed Jan 20, 2018

View reviewed changes

ericchiang force-pushed the oidc-v2 branch from 8eeefd2 to 868f146 Compare January 20, 2018 00:51

ericchiang mentioned this pull request Jan 20, 2018

Move testing providers from Kubernetes to this package coreos/go-oidc#150

Closed

liggitt reviewed Jan 20, 2018

View reviewed changes

ericchiang force-pushed the oidc-v2 branch from 868f146 to 9c3d2a9 Compare January 22, 2018 16:56

ericchiang force-pushed the oidc-v2 branch from 9c3d2a9 to ddbf2e9 Compare January 24, 2018 18:48

liggitt reviewed Jan 26, 2018

View reviewed changes

liggitt added the area/security label Jan 26, 2018

liggitt unassigned dchen1107 Jan 26, 2018

k8s-ci-robot assigned deads2k and unassigned liggitt Jan 27, 2018

ericchiang force-pushed the oidc-v2 branch 2 times, most recently from ba0d4e2 to 4f13d09 Compare January 31, 2018 19:34

thockin removed their assignment Feb 6, 2018

ericchiang force-pushed the oidc-v2 branch from 4f13d09 to 6ea4b66 Compare February 7, 2018 17:19

k8s-ci-robot assigned liggitt Feb 10, 2018

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 10, 2018

mikedanese approved these changes Feb 16, 2018

View reviewed changes

ericchiang added 3 commits February 16, 2018 10:57

oidc authentication: switch to v2 of coreos/go-oidc

48c6d1a

oidc authentication: generate testdata and delete old test packages

2d8cb9c

bump(github.com/coreos/go-oidc): 065b426bd41667456c1a924468f507673629…

379af04

…c46b

ericchiang force-pushed the oidc-v2 branch from 6ea4b66 to 379af04 Compare February 16, 2018 18:58

k8s-github-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 16, 2018

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 16, 2018

k8s-ci-robot assigned thockin Feb 16, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 21, 2018

k8s-github-robot merged commit cdbc4fb into kubernetes:master Feb 21, 2018

ericchiang deleted the oidc-v2 branch February 21, 2018 17:20

ericchiang mentioned this pull request Mar 20, 2018

oidc authentication: hd claim support #61403

Closed

mikedanese mentioned this pull request Jun 22, 2018

Google oidc issuer mismatch: https://accounts.google.com and accounts.google.com #65317

Closed

bcorijn mentioned this pull request Jul 18, 2018

Outdated Google Endpoints can prevent authentication and token refresh bitly/oauth2_proxy#632

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

oidc authentication: switch to v2 of coreos/go-oidc #58544

oidc authentication: switch to v2 of coreos/go-oidc #58544

ericchiang commented Jan 19, 2018 •

edited

Loading

thockin left a comment

rithujohn191 left a comment

rithujohn191 Jan 20, 2018

ericchiang Jan 20, 2018

mikedanese Jan 26, 2018

ericchiang commented Jan 20, 2018

liggitt Jan 20, 2018

liggitt Jan 20, 2018

ericchiang Jan 22, 2018

liggitt Jan 20, 2018 •

edited

Loading

ericchiang Jan 22, 2018

ericchiang commented Jan 22, 2018

ericchiang commented Jan 22, 2018 •

edited

Loading

ericchiang commented Jan 23, 2018

ericchiang commented Jan 24, 2018

ericchiang commented Jan 24, 2018

ericchiang commented Jan 25, 2018

liggitt commented Jan 26, 2018

liggitt Jan 26, 2018

ericchiang Jan 26, 2018

ericchiang Jan 26, 2018

liggitt Jan 26, 2018

liggitt commented Jan 26, 2018 •

edited

Loading

thockin commented Feb 6, 2018

liggitt commented Feb 10, 2018

mikedanese left a comment

mikedanese Feb 16, 2018

mikedanese commented Feb 16, 2018

ericchiang commented Feb 16, 2018

smarterclayton commented Feb 21, 2018

k8s-ci-robot commented Feb 21, 2018

k8s-github-robot commented Feb 21, 2018

k8s-github-robot commented Feb 21, 2018

oidc authentication: switch to v2 of coreos/go-oidc #58544

oidc authentication: switch to v2 of coreos/go-oidc #58544

Conversation

ericchiang commented Jan 19, 2018 • edited Loading

thockin left a comment

Choose a reason for hiding this comment

rithujohn191 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ericchiang commented Jan 20, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt Jan 20, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ericchiang commented Jan 22, 2018

ericchiang commented Jan 22, 2018 • edited Loading

ericchiang commented Jan 23, 2018

ericchiang commented Jan 24, 2018

ericchiang commented Jan 24, 2018

ericchiang commented Jan 25, 2018

liggitt commented Jan 26, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented Jan 26, 2018 • edited Loading

thockin commented Feb 6, 2018

liggitt commented Feb 10, 2018

mikedanese left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikedanese commented Feb 16, 2018

ericchiang commented Feb 16, 2018

smarterclayton commented Feb 21, 2018

k8s-ci-robot commented Feb 21, 2018

k8s-github-robot commented Feb 21, 2018

k8s-github-robot commented Feb 21, 2018

ericchiang commented Jan 19, 2018 •

edited

Loading

liggitt Jan 20, 2018 •

edited

Loading

ericchiang commented Jan 22, 2018 •

edited

Loading

liggitt commented Jan 26, 2018 •

edited

Loading