Policy API: Authorization with API-generated token is failed with “DPoP header is absent” error.

[sievdokymov-virtru]

Policy API calls (both gRPC and HTTP) receive "Unauthorised" error response when using API generated access_token (issued by request to http://localhost:8888/auth/realms/opentdf/protocol/openid-connect/token) for authorisation.
It complains on problem with DPOP validation: “msg="failed to validate token" error="got 0 dpop headers, should have 1"”

E.g.:

Token generated by this suggestion:

Reproducible with locally deployed Platform which uses example env setup with Auth enabled (as described in the Readme)

Additional Info:
Currently DPoP-compatible token can only be generated using SDK as per @mkleene (using

platform/sdk/internal/oauth/oauth.go

Lines 137 to 167 in 2735498

	func GetAccessToken(tokenEndpoint string, scopes []string, clientCredentials ClientCredentials, dpopPrivateKey jwk.Key) (*Token, error) {
	req, err := getAccessTokenRequest(tokenEndpoint, "", scopes, clientCredentials, &dpopPrivateKey)
	if err != nil {
	return nil, err
	}
	client := http.Client{}
	resp, err := client.Do(req)
	if err != nil {
	return nil, fmt.Errorf("error making request to IdP with dpop nonce: %w", err)
	}
	defer resp.Body.Close()
	if nonceHeader := resp.Header.Get("dpop-nonce"); nonceHeader != "" && resp.StatusCode == http.StatusBadRequest {
	nonceReq, err := getAccessTokenRequest(tokenEndpoint, nonceHeader, scopes, clientCredentials, &dpopPrivateKey)
	if err != nil {
	return nil, err
	}
	nonceResp, err := client.Do(nonceReq)
	if err != nil {
	return nil, fmt.Errorf("error making request to IdP with dpop nonce: %w", err)
	}
	defer nonceResp.Body.Close()
	return processResponse(nonceResp)
	}
	return processResponse(resp)
	}

).
And backend validates only DPoP tokens.

Expected Result:
It is possible to generate DPoP-compatible token using direct API call (is it possible to use specific DPoP params?).

Also there is ongoing discussing regarding ability to optionally disable DPoP validation. It could be possible workaround if it doesn't raise additional security concerns.

---

DPoP-related issues: #566, #593

[mkleene]

#617 should resolve this

[sievdokymov-virtru]

Addressed by ability to disable DPoP verification introduced in #617. Verified/Fixed.
Closing as Done.