Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

THREESCALE-10591 token instrospection field removed #1438

Merged
merged 4 commits into from
Jan 23, 2024
Merged

THREESCALE-10591 token instrospection field removed #1438

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
430f9f2
THREESCALE-10591 token instrospection field removed
eguzki Jan 19, 2024
3a43068
spec/policy/token_introspection/token_introspection_spec.lua: unit tests
eguzki Jan 19, 2024
b86c9dc
t/apicast-policy-token-introspection.t: e2e tests
eguzki Jan 19, 2024
ed8ba2a
token_introspection.lua: warning when introspection endpoint is not a…
eguzki Jan 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions gateway/src/apicast/policy/token_introspection/token_introspection.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,21 +94,30 @@ function _M:access(context)

local components = resty_url.parse(context.service.oidc.issuer_endpoint)
self.credential = create_credential(components.user, components.password)
self.introspection_url = context.proxy.oauth.config.token_introspection_endpoint
local oauth_config = context.proxy.oauth.config
-- token_introspection_endpoint being deprecated in RH SSO 7.4 and removed in 7.5
-- https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.5/html-single/upgrading_guide/index#non_standard_token_introspection_endpoint_removed
self.introspection_url = oauth_config.introspection_endpoint or oauth_config.token_introspection_endpoint
end

if self.introspection_url then
local authorization = http_authorization.new(ngx.var.http_authorization)
local access_token = authorization.token
--- Introspection Response must have an "active" boolean value.
-- https://tools.ietf.org/html/rfc7662#section-2.2
if not introspect_token(self, access_token).active == true then
ngx.log(ngx.INFO, 'token introspection for access token ', access_token, ': token not active')
ngx.status = context.service.auth_failed_status
ngx.say(context.service.error_auth_failed)
return ngx.exit(ngx.status)
if introspect_token(self, access_token).active == true then
-- access granted
return
end
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we also output an error when self.introspection_url is nil? So in case self.introspection url is nil then at least we know what happened just by checking the log instead of guessing why the APIcast returned 403 (context.service.error auth_failed)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added 👍

Log level in WARN, as I consider this as an edge case. When the introspection policy is added, the endpoint should be available

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, adding the log line here might be misleading, if self.introspection_url is valid but introspect_token(self, access_token).active == false then it will first log the token introspection for the token.. line then output token instropection cannot be performed..... Perhaps wrap it in the else statement?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch!

Fixed


ngx.log(ngx.INFO, 'token introspection for access token ', access_token, ': token not active')
else
ngx.log(ngx.WARN, 'token instropection cannot be performed as introspection endpoint is not available')
end

ngx.status = context.service.auth_failed_status
ngx.say(context.service.error_auth_failed)
return ngx.exit(ngx.status)
end

return _M
Loading
Loading