opendut
opendut copied to clipboard
LEA should use the issuer which was provided by the config
LEA is using a hard-coded String for its issuer to decode tokens. This is not correct.
// opendut-lea/src/components/auth.rs
pub(crate) fn decode_token(token: &str) -> TokenData<Claims> {
let mut validation = Validation::new(Algorithm::RS256);
validation.set_issuer(&["https://keycloak/realms/opendut".to_string()]); // TODO: get from config
validation.set_audience(&["account".to_string()]);
validation.insecure_disable_signature_validation();
let decoding_key = DecodingKey::from_secret(&[]);
jsonwebtoken::decode::<Claims>(token, &decoding_key, &validation).expect("failed to decode")
}
Instead of a hard-coded String the AppConfig offers the issuer as parameter, which can be used by LEA.