Support for mutil-value audience claims in JWT token by rstyp · Pull Request #13490 · trinodb/trino

rstyp · 2022-08-04T01:06:50Z

Description

requiredAudience validation fails if aud claim contains multiple audiences in JWT token.

Remove jwtParser.requireAudience(config.getRequiredAudience()); to not to validate aud during parseClaimsJws.
Add validateAudience method and call it from createIdentity

Is this change a fix, improvement, new feature, refactoring, or other?

a fix

Is this a change to the core query engine, a connector, client library, or the SPI interfaces? (be specific)

JWT Authentication

How would you describe this change to a non-technical end user or system administrator?

Support for mutil-value audience claims in JWT token

Related issues, pull requests, and links

#13442

Documentation

( *) No documentation is needed.
( ) Sufficient documentation is included in this PR.
( ) Documentation PR is available with #prnumber.
( ) Documentation issue #issuenumber is filed, and can be handled later.

Release notes

( ) No release notes entries required.
( ) Release notes entries required with the following suggested text:

# JWT Authentication
* Support for mutil-value audience claims in JWT token. ({issue}`13442 `)

cla-bot · 2022-08-04T01:06:52Z

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: rstyp.
This is most likely caused by a git client misconfiguration; please make sure to:

check if your git client is configured with an email to sign commits git config --list | grep email
If not, set it up using git config --global user.email email@example.com
Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

cla-bot · 2022-08-04T01:31:13Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

lukasz-walkiewicz

Looks like a good start but we need to add tests for this change.
Please take a look at io.trino.server.security.TestResourceSecurity. There are a few test for JWT authentication.

lukasz-walkiewicz · 2022-08-05T13:56:11Z

core/trino-main/src/main/java/io/trino/server/security/jwt/JwtAuthenticator.java

Typically we use Optional for values that can have null.

@lukasz-walkiewicz changed it to Optional

cla-bot · 2022-08-06T05:56:34Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2022-08-11T05:45:37Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

cla-bot · 2022-08-12T07:14:33Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

lukasz-walkiewicz · 2022-08-12T09:25:18Z

@rstyp Please sign CLA. See instructions from cla-bot.

cla-bot · 2022-08-12T18:10:36Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

rstyp · 2022-08-22T17:26:29Z

@lukasz-walkiewicz CLA is signed now.

lukasz-walkiewicz

Sorry for the delay @rstyp. Looks good, just a couple of minor comments.

lukasz-walkiewicz · 2022-09-15T10:01:01Z

core/trino-main/src/main/java/io/trino/server/security/jwt/JwtAuthenticator.java


+    private void validateAudience(Claims claims)
+    {
+        Object tokenAudience = claims.get(AUDIENCE);


change order, if requiredAudience is empty then getting audience from claims is redundant

lukasz-walkiewicz · 2022-09-15T10:03:26Z

core/trino-main/src/test/java/io/trino/server/security/TestResourceSecurity.java

    }

+    @Test
+    public void testJwtAuthenticatorWithInvalidAudience()


I think we're missing a test with empty audience and without http-server.authentication.jwt.required-audience specified.

lukasz-walkiewicz

Thank you @rstyp. LGTM 👍
@kokosing could you please take a look as well and merge it?

rstyp · 2022-09-21T00:56:08Z

Thank you @lukasz-walkiewicz

kokosing · 2022-09-21T11:56:26Z

CI hit: #12818

kokosing · 2022-09-21T11:57:28Z

CI hit: #13288

kokosing · 2022-09-21T11:59:27Z

Merged, thanks

rstyp force-pushed the jwt-aud branch from 3adef1d to 3cb7c18 Compare August 4, 2022 01:31

findinpath requested a review from lukasz-walkiewicz August 4, 2022 07:23

lukasz-walkiewicz reviewed Aug 5, 2022

View reviewed changes

rstyp requested a review from lukasz-walkiewicz August 8, 2022 17:37

rstyp force-pushed the jwt-aud branch from 905725d to 977f56d Compare August 11, 2022 05:45

rstyp force-pushed the jwt-aud branch from 977f56d to 3986698 Compare August 12, 2022 07:14

Support for mutil-value audience claims in JWT token

91a7460

rstyp force-pushed the jwt-aud branch from 3986698 to 071030f Compare August 12, 2022 18:10

Add test for JWT in TestResourceSecurity

e8ed3d5

rstyp force-pushed the jwt-aud branch from 071030f to e8ed3d5 Compare August 22, 2022 01:05

cla-bot bot added the cla-signed label Aug 22, 2022

lukasz-walkiewicz reviewed Sep 15, 2022

View reviewed changes

lukasz-walkiewicz requested a review from kokosing September 15, 2022 11:56

kokosing requested review from 11xor6 and s2lomon September 15, 2022 12:02

add test with empty audience and without required-audience

10dda6f

lukasz-walkiewicz approved these changes Sep 20, 2022

View reviewed changes

kokosing merged commit ccfcb9d into trinodb:master Sep 21, 2022

github-actions bot added this to the 397 milestone Sep 21, 2022

colebow mentioned this pull request Sep 21, 2022

Add Trino 397 release notes #14194

Merged

jhbigler mentioned this pull request Feb 29, 2024

Trino 380 cannot verify JWT Audience #20868

Closed

Conversation

rstyp commented Aug 4, 2022

Description

Related issues, pull requests, and links

Documentation

Release notes

Uh oh!

cla-bot bot commented Aug 4, 2022

Uh oh!

cla-bot bot commented Aug 4, 2022

Uh oh!

lukasz-walkiewicz left a comment

Choose a reason for hiding this comment

Uh oh!

lukasz-walkiewicz Aug 5, 2022

Choose a reason for hiding this comment

Uh oh!

rstyp Aug 12, 2022

Choose a reason for hiding this comment

Uh oh!

cla-bot bot commented Aug 6, 2022

Uh oh!

cla-bot bot commented Aug 11, 2022

Uh oh!

cla-bot bot commented Aug 12, 2022

Uh oh!

lukasz-walkiewicz commented Aug 12, 2022

Uh oh!

cla-bot bot commented Aug 12, 2022

Uh oh!

rstyp commented Aug 22, 2022

Uh oh!

lukasz-walkiewicz left a comment

Choose a reason for hiding this comment

Uh oh!

lukasz-walkiewicz Sep 15, 2022

Choose a reason for hiding this comment

Uh oh!

lukasz-walkiewicz Sep 15, 2022

Choose a reason for hiding this comment

Uh oh!

lukasz-walkiewicz left a comment

Choose a reason for hiding this comment

Uh oh!

rstyp commented Sep 21, 2022

Uh oh!

kokosing commented Sep 21, 2022

Uh oh!

kokosing commented Sep 21, 2022

Uh oh!

kokosing commented Sep 21, 2022

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants