Vault: enforce JWT OAuth scope per JSON-RPC method#22314
Vault: enforce JWT OAuth scope per JSON-RPC method#22314prashantkumar1982 merged 5 commits intodevelopfrom
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
product-security-plaid-production
Bot
requested review from
justinkaseman and
patrickhuie19
prashantkumar1982
force-pushed
the
fix/vault-jwt-scope-method-auth
branch
from
4f8564d to
23fd54f
Compare
|
I see you updated files related to
|
Reject Vault JWT auth when scope/permissions do not match the requested method (create/update/delete/list secrets). Keeps digest binding as integrity control. Aligns with CRE OAuth scopes used by GraphQL. Updates system-test JWT minting to include the correct scope per method. Co-authored-by: Cursor <cursoragent@cursor.com>
prashantkumar1982
force-pushed
the
fix/vault-jwt-scope-method-auth
branch
from
23fd54f to
284135a
Compare
|
✅ No conflicts with other open PRs targeting |
prashantkumar1982
changed the title
|
|
||
| // OAuthScopeForVaultRPCMethod returns the OAuth scope required to authorize the given | ||
| // Vault JSON-RPC method over the JWT path. | ||
| func OAuthScopeForVaultRPCMethod(method string) (string, error) { |
There was a problem hiding this comment.
this is exported but lacks direct unit-test coverage
There was a problem hiding this comment.
It is called from here:
Added more unit-tests too.
| return scopes[0], nil | ||
| } | ||
|
|
||
| func extractOAuthScopesFromClaims(claims jwt.MapClaims) []string { |
There was a problem hiding this comment.
only 67% of test coverage in cases
There was a problem hiding this comment.
now have all test-cases
| }, | ||
| } | ||
|
|
||
| if len(claims.Scopes) > 0 { |
There was a problem hiding this comment.
q: There shouldn't be more than 1 scope per token, should we check for that and possibly err?
There was a problem hiding this comment.
Ok, I am validating that request token only has 1 vault scope. Other scopes not vault related are ignored but not errored upon.
Enforce exactly one known Vault secret scope per token (ignore non-Vault claims). Add OAuthScopeForVaultRPCMethod unit tests and JWT auth tests for multi-scope and openid+vault cases. Co-authored-by: Cursor <cursoragent@cursor.com>
|
4 participants
Summary
Vault JWT path previously validated only request digest binding, not whether the token OAuth scope authorizes the requested JSON-RPC method.
Changes
scope(space-separated) and Auth0-stylepermissionsarray claims.create:secrets/update:secrets/delete:secrets/list:secretsmapped tovault.secrets.*methods. Fail closed on missing or non-matching scope.