[extension/oidcauth] Add static public_keys_file to configuration #45315
+541
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Welcome, contributor! Thank you for your contribution to opentelemetry-collector-contrib. Important reminders:
A maintainer will review your pull request soon. Thank you for helping make OpenTelemetry better! |
When provided, the extension will attempt to load a static set of public keys from a JWKS file at the given path. These keys (and only these keys) will be used to verify the signatures of incoming tokens. Discovery will be disabled for any provider so configured. In addition, the extension will set up a file watcher for each directory referenced in this way, and will hot-reload the static keys in the JWKS file whenever a change is noticed. This allows keys to be rotated without necessarily needing to restart the collector. We extend the `providerContainer` with a `Verify` method, so that we can encapsulate the decision of "should we grab the mutex" in one location (we only need to grab the mutex when using static configuration - it's unused otherwise and we can avoid paying the cost of grabbing the lock). Due to limitations of the underlying `go-oidc` library, only RSA, ECDSA, and ED25519 public keys are supported.
ahayworth
force-pushed
the
ahayworth/oidc-static-verifier
branch
from
e311401 to
7f5cb84
Compare
Author
|
/rerun |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
When provided, the extension will attempt to load a static set of public keys from a JWKS file at the given path. These keys (and only these keys) will be used to verify the signatures of incoming tokens. Discovery will be disabled for any provider so configured.
In addition, the extension will set up a file watcher for each directory referenced in this way, and will hot-reload the static keys in the JWKS file whenever a change is noticed. This allows keys to be rotated without necessarily needing to restart the collector. We extend the
providerContainerwith aVerifymethod, so that we can encapsulate the decision of "should we grab the mutex" in one location (we only need to grab the mutex when using static configuration - it's unused otherwise and we can avoid paying the cost of grabbing the lock).Due to limitations of the underlying
go-oidclibrary, only RSA, ECDSA, and ED25519 public keys are supported.Link to tracking issue
Fixes #44899
Testing
The following tests were added:
public_keys_filepublic_keys_filepublic_keys_fileAdditionally, I manually tested that I could sign a JWT with an internal key, send telemetry to a local collector using that JWT as an auth header, and that the collector validated the signature and accepted the telemetry with keys from the
public_keys_file. I had my network disabled for good measure, to ensure we didn't try to load it from our internal OIDC discovery endpoint. 😄Documentation
The README was updated to reference the new configuration setting.