Vault 33101 - Optionally ignore trailing slash in bound audience #159
Conversation
jimlambrt
left a comment
There was a problem hiding this comment.
Can you update the PR description to something that doesn't describe the change related to a specific vault plugin?
Basically, you should give some background information related to audiences (and likely the issuer as well - see below) and this change is being proposed and the implications of making the change. This should include references to the appropriate internet RFCs about this very topic and in particular URI comparisons. This will allow the PR reviewer, future maintainers, and pkg consumers to understand why this change was made and the implications to every pkg consumer. There were several slack threads that might help inform this more complete description.
jimlambrt
left a comment
There was a problem hiding this comment.
Can you use the existing options pattern that's used throughout pkgs in the repo?
jimlambrt
left a comment
There was a problem hiding this comment.
Can you add the appropriate unit tests to this PR which cover all proposed changes?
Sorry about that. Was in the middle of updating the description when you were reviewing. |
Unit tests were already added. |
I don't believe that there was an RFC doc for this change, but I did update the description again to satisfy the rest of your requirements to the best of my ability. |
Description
When logging into vault, each boubd audience is compared against aud claims to verify a match to determine whether the user can authenticate. This PR adds the option to normalize bound audiences (i.e. compare the bound audience to the aud claims without a trailing slash if it exists).
This change is needed because when some customers have reported browser inconsistency when providing their bound audiences (some browsers produce a URL with a slash, and other produce a URL without a slash). This affects their ability to authenticate.
Example
If normalization of bound audiences is enabled the bound audience
foo.com\will match against the aud claimfoo.com. However, when normalization is not enabled, it will not match against it.Implications
The impact of this change to users of cap is minimal. Bound audiences are not normalized by default. Enabling normalization involves enabling the option
WithNormalizedAudienceswhen callingValidate. Unit tests were updated to verify that this is the case.Changes in this PR include
WithNormalizedAudiencesto normalize bound audiences when enabledWithNormalizedAudiencesis not enabled and to verify that normalization is working correctly when the feature is enabled.optstoValidate,validateAll, andvalidateAudiences