Skip to content

Validate subject tokens from external OIDC issuers #5995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jhrozek merged 4 commits into from
Jul 27, 2026
Merged

Validate subject tokens from external OIDC issuers #5995

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
04dc8fe
Extract SubjectTokenValidator interface for multi-issuer support
jhrozek Apr 12, 2026
75b82d6
Add multi-issuer token validator for external OIDC token exchange
jhrozek Apr 12, 2026
51b80eb
Fail loudly on empty ExpectedAudience, fix subject-token error code
jhrozek Jul 14, 2026
6f06d54
Harden multi-issuer validator, fix review findings
jhrozek Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pkg/authserver/server/tokenexchange/factory.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ func Factory(delegationLifespan time.Duration) (server.Factory, error) {
time.Duration(0), server.MaxAccessTokenLifespan, delegationLifespan)
}
return func(config *server.AuthorizationServerConfig, storage fosite.Storage, strategy any) (any, error) {
validator, err := NewSubjectTokenValidator(config.PublicJWKS(), config.GetAccessTokenIssuer(), config.AllowedAudiences)
validator, err := NewSelfIssuedTokenValidator(config.PublicJWKS(), config.GetAccessTokenIssuer(), config.AllowedAudiences)
if err != nil {
return nil, fmt.Errorf("tokenexchange: failed to create subject token validator: %w", err)
}
Expand Down
10 changes: 8 additions & 2 deletions pkg/authserver/server/tokenexchange/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ const maxDelegationDepth = 10
// token effort.
type Handler struct {
*oauth2.HandleHelper
validator *SubjectTokenValidator
validator SubjectTokenValidator
delegationLifespan time.Duration
config tokenExchangeConfig
allowedAudiences []string
Expand Down Expand Up @@ -115,7 +115,13 @@ func (h *Handler) HandleTokenEndpointRequest(ctx context.Context, requester fosi
"error", err,
"actor", actorID,
)
return errorsx.WithStack(fosite.ErrInvalidGrant.WithHint(
// TODO(#5989): this maps every validation failure to invalid_request,
// which is correct for a malformed/unverifiable subject token. Once the
// multi-issuer validator is wired in, grant-level failures reachable only
// on the external path (untrusted issuer, wrong audience, expired) should
// map to invalid_grant per RFC 6749 §5.2; that needs typed validator
// errors the handler can distinguish.
return errorsx.WithStack(fosite.ErrInvalidRequest.WithHint(
"The subject token is invalid or could not be verified."))
}

Expand Down
6 changes: 3 additions & 3 deletions pkg/authserver/server/tokenexchange/handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ const testAgentClientID = "devops-agent"
func newTestHandler(t *testing.T, tj *testJWKS, delegationLifespan time.Duration) *Handler {
t.Helper()

validator, err := NewSubjectTokenValidator(tj.publicJWKS(), testIssuer, []string{testIssuer})
validator, err := NewSelfIssuedTokenValidator(tj.publicJWKS(), testIssuer, []string{testIssuer})
require.NoError(t, err)

return &Handler{
Expand Down Expand Up @@ -258,7 +258,7 @@ func TestTokenExchangeHandler_HandleTokenEndpointRequest(t *testing.T) {
},
lifespan: 15 * time.Minute,
wantErr: true,
wantFositeIs: fosite.ErrInvalidGrant,
wantFositeIs: fosite.ErrInvalidRequest,
hintContains: "subject token is invalid",
},
{
Expand Down Expand Up @@ -963,7 +963,7 @@ func newTestHandlerWithHelper(t *testing.T, tj *testJWKS, accessLifespan time.Du

const delegationLifespan = 15 * time.Minute

validator, err := NewSubjectTokenValidator(tj.publicJWKS(), testIssuer, []string{testIssuer})
validator, err := NewSelfIssuedTokenValidator(tj.publicJWKS(), testIssuer, []string{testIssuer})
require.NoError(t, err)

cfg := &mockConfig{
Expand Down
Loading
Loading