Skip to content

Commit 1595743

Browse files
zhaohuabingzhaohuabing
authored
api for id token forwarding (#8691)
* api for id token forwarding Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
1 parent 52bafc6 commit 1595743

8 files changed

Lines changed: 156 additions & 0 deletions

File tree

‎api/v1alpha1/oidc_types.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ const (
1616

1717
// OIDC defines the configuration for the OpenID Connect (OIDC) authentication.
1818
// +kubebuilder:validation:XValidation:rule="(has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID) && has(self.clientIDRef))", message="only one of clientID or clientIDRef must be set"
19+
// +kubebuilder:validation:XValidation:rule="!(has(self.forwardAccessToken) && self.forwardAccessToken && has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii() == 'authorization')", message="forwardAccessToken cannot be true when forwardIDToken.header is Authorization"
1920
type OIDC struct {
2021
// The OIDC Provider configuration.
2122
Provider OIDCProvider `json:"provider"`
@@ -99,6 +100,14 @@ type OIDC struct {
99100
// +optional
100101
ForwardAccessToken *bool `json:"forwardAccessToken,omitempty"`
101102

103+
// ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
104+
//
105+
// If the configured header is "Authorization", EG forwards the ID token using
106+
// the "Bearer " prefix. For any other header, EG forwards the raw token value.
107+
// If not specified, the ID token will not be forwarded.
108+
// +optional
109+
ForwardIDToken *OIDCTokenForwarding `json:"forwardIDToken,omitempty"`
110+
102111
// DefaultTokenTTL is the default lifetime of the id token and access token.
103112
// Please note that Envoy will always use the expiry time from the response
104113
// of the authorization server if it is provided. This field is only used when
@@ -234,6 +243,13 @@ type OIDCCookieNames struct {
234243
IDToken *string `json:"idToken,omitempty"`
235244
}
236245

246+
// OIDCTokenForwarding defines how an OIDC token is forwarded upstream.
247+
type OIDCTokenForwarding struct {
248+
// Header is the upstream request header that will carry the ID token.
249+
// +kubebuilder:validation:MinLength=1
250+
Header string `json:"header"`
251+
}
252+
237253
type SameSite string
238254

239255
const (

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5432,6 +5432,22 @@ spec:
54325432
via the Authorization header Bearer scheme to the upstream.
54335433
If not specified, defaults to false.
54345434
type: boolean
5435+
forwardIDToken:
5436+
description: |-
5437+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
5438+
5439+
If the configured header is "Authorization", EG forwards the ID token using
5440+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
5441+
If not specified, the ID token will not be forwarded.
5442+
properties:
5443+
header:
5444+
description: Header is the upstream request header that will
5445+
carry the ID token.
5446+
minLength: 1
5447+
type: string
5448+
required:
5449+
- header
5450+
type: object
54355451
logoutPath:
54365452
description: |-
54375453
The path to log a user out, clearing their credential cookies.
@@ -6889,6 +6905,11 @@ spec:
68896905
- message: only one of clientID or clientIDRef must be set
68906906
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
68916907
&& has(self.clientIDRef))
6908+
- message: forwardAccessToken cannot be true when forwardIDToken.header
6909+
is Authorization
6910+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
6911+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
6912+
== ''authorization'')'
68926913
targetRef:
68936914
description: |-
68946915
TargetRef is the name of the resource this policy is being attached to.

‎charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5431,6 +5431,22 @@ spec:
54315431
via the Authorization header Bearer scheme to the upstream.
54325432
If not specified, defaults to false.
54335433
type: boolean
5434+
forwardIDToken:
5435+
description: |-
5436+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
5437+
5438+
If the configured header is "Authorization", EG forwards the ID token using
5439+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
5440+
If not specified, the ID token will not be forwarded.
5441+
properties:
5442+
header:
5443+
description: Header is the upstream request header that will
5444+
carry the ID token.
5445+
minLength: 1
5446+
type: string
5447+
required:
5448+
- header
5449+
type: object
54345450
logoutPath:
54355451
description: |-
54365452
The path to log a user out, clearing their credential cookies.
@@ -6888,6 +6904,11 @@ spec:
68886904
- message: only one of clientID or clientIDRef must be set
68896905
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
68906906
&& has(self.clientIDRef))
6907+
- message: forwardAccessToken cannot be true when forwardIDToken.header
6908+
is Authorization
6909+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
6910+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
6911+
== ''authorization'')'
68916912
targetRef:
68926913
description: |-
68936914
TargetRef is the name of the resource this policy is being attached to.

‎site/content/en/latest/api/extension_types.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4007,6 +4007,7 @@ _Appears in:_
40074007
| `denyRedirect` | _[OIDCDenyRedirect](#oidcdenyredirect)_ | false | | Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.<br />This behavior can be useful for AJAX or machine requests. |
40084008
| `logoutPath` | _string_ | true | | The path to log a user out, clearing their credential cookies.<br />If not specified, uses a default logout path "/logout" |
40094009
| `forwardAccessToken` | _boolean_ | false | | ForwardAccessToken indicates whether the Envoy should forward the access token<br />via the Authorization header Bearer scheme to the upstream.<br />If not specified, defaults to false. |
4010+
| `forwardIDToken` | _[OIDCTokenForwarding](#oidctokenforwarding)_ | false | | ForwardIDToken configures forwarding of the OIDC ID token to the upstream.<br />If the configured header is "Authorization", EG forwards the ID token using<br />the "Bearer " prefix. For any other header, EG forwards the raw token value.<br />If not specified, the ID token will not be forwarded. |
40104011
| `defaultTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/1.5/spec/#duration)_ | false | | DefaultTokenTTL is the default lifetime of the id token and access token.<br />Please note that Envoy will always use the expiry time from the response<br />of the authorization server if it is provided. This field is only used when<br />the expiry time is not provided by the authorization.<br />If not specified, defaults to 0. In this case, the "expires_in" field in<br />the authorization response must be set by the authorization server, or the<br />OAuth flow will fail. |
40114012
| `refreshToken` | _boolean_ | false | true | RefreshToken indicates whether the Envoy should automatically refresh the<br />id token and access token when they expire.<br />When set to true, the Envoy will use the refresh token to get a new id token<br />and access token when they expire.<br />If not specified, defaults to true. |
40124013
| `defaultRefreshTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/1.5/spec/#duration)_ | false | | DefaultRefreshTokenTTL is the default lifetime of the refresh token.<br />This field is only used when the exp (expiration time) claim is omitted in<br />the refresh token or the refresh token is not JWT.<br />If not specified, defaults to 604800s (one week).<br />Note: this field is only applicable when the "refreshToken" field is set to true. |
@@ -4102,6 +4103,20 @@ _Appears in:_
41024103
| `endSessionEndpoint` | _string_ | false | | The OIDC Provider's [end session endpoint](https://openid.net/specs/openid-connect-core-1_0.html#RPLogout).<br />If the end session endpoint is provided, EG will use it to log out the user from the OIDC Provider when the user accesses the logout path.<br />EG will also try to discover the end session endpoint from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse) when authorizationEndpoint or tokenEndpoint is not provided. |
41034104

41044105

4106+
#### OIDCTokenForwarding
4107+
4108+
4109+
4110+
OIDCTokenForwarding defines how an OIDC token is forwarded upstream.
4111+
4112+
_Appears in:_
4113+
- [OIDC](#oidc)
4114+
4115+
| Field | Type | Required | Default | Description |
4116+
| --- | --- | --- | --- | --- |
4117+
| `header` | _string_ | true | | Header is the upstream request header that will carry the ID token. |
4118+
4119+
41054120
#### OTelSampler
41064121

41074122

‎test/helm/gateway-crds-helm/all.out.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54787,6 +54787,22 @@ spec:
5478754787
via the Authorization header Bearer scheme to the upstream.
5478854788
If not specified, defaults to false.
5478954789
type: boolean
54790+
forwardIDToken:
54791+
description: |-
54792+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
54793+
54794+
If the configured header is "Authorization", EG forwards the ID token using
54795+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
54796+
If not specified, the ID token will not be forwarded.
54797+
properties:
54798+
header:
54799+
description: Header is the upstream request header that will
54800+
carry the ID token.
54801+
minLength: 1
54802+
type: string
54803+
required:
54804+
- header
54805+
type: object
5479054806
logoutPath:
5479154807
description: |-
5479254808
The path to log a user out, clearing their credential cookies.
@@ -56244,6 +56260,11 @@ spec:
5624456260
- message: only one of clientID or clientIDRef must be set
5624556261
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
5624656262
&& has(self.clientIDRef))
56263+
- message: forwardAccessToken cannot be true when forwardIDToken.header
56264+
is Authorization
56265+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
56266+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
56267+
== ''authorization'')'
5624756268
targetRef:
5624856269
description: |-
5624956270
TargetRef is the name of the resource this policy is being attached to.

‎test/helm/gateway-crds-helm/e2e.out.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32760,6 +32760,22 @@ spec:
3276032760
via the Authorization header Bearer scheme to the upstream.
3276132761
If not specified, defaults to false.
3276232762
type: boolean
32763+
forwardIDToken:
32764+
description: |-
32765+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
32766+
32767+
If the configured header is "Authorization", EG forwards the ID token using
32768+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
32769+
If not specified, the ID token will not be forwarded.
32770+
properties:
32771+
header:
32772+
description: Header is the upstream request header that will
32773+
carry the ID token.
32774+
minLength: 1
32775+
type: string
32776+
required:
32777+
- header
32778+
type: object
3276332779
logoutPath:
3276432780
description: |-
3276532781
The path to log a user out, clearing their credential cookies.
@@ -34217,6 +34233,11 @@ spec:
3421734233
- message: only one of clientID or clientIDRef must be set
3421834234
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
3421934235
&& has(self.clientIDRef))
34236+
- message: forwardAccessToken cannot be true when forwardIDToken.header
34237+
is Authorization
34238+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
34239+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
34240+
== ''authorization'')'
3422034241
targetRef:
3422134242
description: |-
3422234243
TargetRef is the name of the resource this policy is being attached to.

‎test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32760,6 +32760,22 @@ spec:
3276032760
via the Authorization header Bearer scheme to the upstream.
3276132761
If not specified, defaults to false.
3276232762
type: boolean
32763+
forwardIDToken:
32764+
description: |-
32765+
ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
32766+
32767+
If the configured header is "Authorization", EG forwards the ID token using
32768+
the "Bearer " prefix. For any other header, EG forwards the raw token value.
32769+
If not specified, the ID token will not be forwarded.
32770+
properties:
32771+
header:
32772+
description: Header is the upstream request header that will
32773+
carry the ID token.
32774+
minLength: 1
32775+
type: string
32776+
required:
32777+
- header
32778+
type: object
3276332779
logoutPath:
3276432780
description: |-
3276532781
The path to log a user out, clearing their credential cookies.
@@ -34217,6 +34233,11 @@ spec:
3421734233
- message: only one of clientID or clientIDRef must be set
3421834234
rule: (has(self.clientID) && !has(self.clientIDRef)) || (!has(self.clientID)
3421934235
&& has(self.clientIDRef))
34236+
- message: forwardAccessToken cannot be true when forwardIDToken.header
34237+
is Authorization
34238+
rule: '!(has(self.forwardAccessToken) && self.forwardAccessToken
34239+
&& has(self.forwardIDToken) && self.forwardIDToken.header.lowerAscii()
34240+
== ''authorization'')'
3422034241
targetRef:
3422134242
description: |-
3422234243
TargetRef is the name of the resource this policy is being attached to.

0 commit comments

Comments
 (0)