envoyproxy
Validate ID Token when OIDC is set
Description:
Describe the desired behavior, what scenario it enables and how it would be used.
The OIDC spec calls out verifying the ID Token https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
This be be enabled by default or opt in
[optional Relevant Links:]
Any extra documentation required to understand the issue.
Hey, I'm looking to start working on Envoy Gateway and wouldn't mind picking this one up
thanks for picking this one up @markwinter, recommend starting off with an API PR
@arkodg @markwinter I believe this needs to be supported by the Envoy OAuth2 filter first, then we can enable validation in EG.
I found related discussions here https://github.com/envoyproxy/gateway/discussions/2425#discussioncomment-8722381 https://github.com/envoyproxy/envoy/issues/32805
I checked that the forward_bearer_token in the oauth2 filter will set the access token in the Authorization header
https://github.com/envoyproxy/envoy/blob/22a07c31780d8b3b95460c0cc7333ab5e14b89ab/source/extensions/filters/http/oauth2/filter.cc#L882-L884
Perhaps this can be implemented by combining oauth2 filter and jwt filter as you mentioned @arkodg , and using jwtExtrator/from_cookies to get the id token from the cookie set by oauth2 filter.
I think I know the path forward here so will start on the API PR
@arkodg Opened the API PR here if you could have a look please and see if aligns with what you were thinking https://github.com/envoyproxy/gateway/pull/5443
@zhaohuabing can't we add jwt authn if this field is set ?
@arkodg @markwinter I think JWT authentication is used for general-purpose authentication with JWT tokens. However, ID Token Validation requires additional checks specific to OIDC ID tokens. Some general checks, such as iss and aud claim validation, can be done with the JWT filter, but others—such as alg, nonce, and acr—require validation rules that are unique to OIDC and can't be achieved with the JWT filter.
If our immediate goal is to validate only the iss and aud claims, this can be handled within the JWT section of a SecurityPolicy. Introducing partial validation within the OIDC API does not provide significant value, as it would duplicate existing functionality of the JWT authn.
@zhaohuabing
Verifying the alg is part of JWT signed token verification, that's why JWKS can be supplied in the JWT Authentication filter.
https://github.com/envoyproxy/envoy/blob/eb398e9e4e0e33c8d68d5b9f86db88f236fd57c4/source/extensions/filters/http/jwt_authn/authenticator.cc#L324
https://github.com/google/jwt_verify_lib/blob/master/src/verify.cc#L210
The nonce and acr are oidc specific though and are dependent on whether they were requested in the initial authentication request
@zhaohuabing
Verifying the alg is part of JWT signed token verification, that's why JWKS can be supplied in the JWT Authentication filter.
I mean this alg validation:
The alg value SHOULD be the default of RS256 or the algorithm sent by the Client in the id_token_signed_response_alg parameter during Registration
I am also +1 to add fully conformance with OIDC validations natively to Envoy OAuth2 filter. Another benefit is that then from envoy perspective OAuth2 filter can be isolated used, instead of relying for validation on the jwt filter, which means it is secure by default. Secure by default is generally a good idea from my point of view.
This issue has been automatically marked as stale because it has not had activity in the last 30 days.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue has been automatically marked as stale because it has not had activity in the last 30 days.
@Windfarer Do you have use case for this?
I believe we need to add OIDC ID Token validation in the upstream Envoy OAuth2 filter because of this.
This issue has been automatically marked as stale because it has not had activity in the last 30 days.
If ID token validation is missing, OIDC isn't implemented. https://github.com/envoyproxy/gateway/issues/881 isn't really completed.
Should the docs maybe be updated to explain the current state?
It's quite difficult to do the aud/iss claim validation using jwt option of the SecurityPolicy since the name of the cookie with the idtoken gets a random suffix at the moment.
EDIT: Just needed to set oidc.cookieNames.idToken
chatted with @zhaohuabing and this / https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation needs to be implemented in upstream
is there an existing issue for this @zhaohuabing ?