3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-06 10:21:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

always pass full identity claims for the /.pomerium/jwt endpoint

Browse source
This commit is contained in:
Caleb Doxsey 2024-07-29 16:04:15 -06:00
parent e0554d111a
commit bb54e8b381
3 changed files with 5 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
authorize/evaluator/headers_evaluator.go
View file

@ -46,6 +46,10 @@ func NewHeadersRequestFromPolicy(options *config.Options, policy *config.Policy,
input.SetRequestHeaders = policy.SetRequestHeaders input.SetRequestHeaders = policy.SetRequestHeaders
input.PassIdentityHeaders = policy.GetPassIdentityHeaders(options) input.PassIdentityHeaders = policy.GetPassIdentityHeaders(options)
} }
// always pass identity headers when requesting the special /.pomerium/jwt endpoint
if http.Path == "/.pomerium/jwt" {
input.PassIdentityHeaders = true
}
return input return input
} }

2
integration/policy_test.go
View file

@ -559,7 +559,7 @@ func TestPomeriumJWT(t *testing.T) {
func rawJWTPayload(t *testing.T, jwt string) map[string]any { func rawJWTPayload(t *testing.T, jwt string) map[string]any {
t.Helper() t.Helper()
s := strings.Split(jwt, ".") s := strings.Split(jwt, ".")
require.Equal(t, 3, len(s), "unexpected JWT format") require.Equal(t, 3, len(s), "unexpected JWT format: %s", jwt)
payload, err := base64.RawURLEncoding.DecodeString(s[1]) payload, err := base64.RawURLEncoding.DecodeString(s[1])
require.NoError(t, err, "JWT payload could not be decoded") require.NoError(t, err, "JWT payload could not be decoded")
d := json.NewDecoder(bytes.NewReader(payload)) d := json.NewDecoder(bytes.NewReader(payload))

13
proxy/handlers.go
View file

@ -6,7 +6,6 @@ import (
"net/http" "net/http"
"net/url" "net/url"
"github.com/go-jose/go-jose/v3/jwt"
"github.com/gorilla/mux" "github.com/gorilla/mux"
"github.com/pomerium/pomerium/internal/handlers" "github.com/pomerium/pomerium/internal/handlers"
@ -143,18 +142,6 @@ func (p *Proxy) jwtAssertion(w http.ResponseWriter, r *http.Request) error {
return httputil.NewError(http.StatusNotFound, errors.New("jwt not found")) return httputil.NewError(http.StatusNotFound, errors.New("jwt not found"))
} }
assertionJWT, err := jwt.ParseSigned(rawAssertionJWT)
if err != nil {
return httputil.NewError(http.StatusNotFound, errors.New("jwt not found"))
}
var dst struct {
Subject string `json:"sub"`
}
if assertionJWT.UnsafeClaimsWithoutVerification(&dst) != nil || dst.Subject == "" {
return httputil.NewError(http.StatusUnauthorized, errors.New("jwt not found"))
}
w.Header().Set("Content-Type", "application/jwt") w.Header().Set("Content-Type", "application/jwt")
w.WriteHeader(http.StatusOK) w.WriteHeader(http.StatusOK)
_, _ = io.WriteString(w, rawAssertionJWT) _, _ = io.WriteString(w, rawAssertionJWT)