luxolus
/
open-vault
2
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

Handle JWT checks with namespaced service tokens (#6536) 

Some checks would fail because we considered a token with two dots a
JWT, but service tokens in namespaces also fit this bill.
This commit is contained in:
Jeff Mitchell 2019-04-04 17:13:09 -04:00 committed by GitHub
parent c076c8429f
commit eec3f9afb2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
http/handler.go
View File

@ -696,10 +696,17 @@ func requestAuth(core *vault.Core, r *http.Request, req *logical.Request) (*logi
// Also attach the accessor if we have it. This doesn't fail if it
// doesn't exist because the request may be to an unauthenticated
// endpoint/login endpoint where a bad current token doesn't matter, or
// a token from a Vault version pre-accessors.
// a token from a Vault version pre-accessors. We ignore errors for
// JWTs.
te, err := core.LookupToken(r.Context(), token)
if err != nil && strings.Count(token, ".") != 2 {
return req, err
if err != nil {
dotCount := strings.Count(token, ".")
// If we have two dots but the second char is a dot it's a vault
// token of the form s.SOMETHING.nsid, not a JWT
if dotCount != 2 ||
dotCount == 2 && token[1] == '.' {
return req, err
}
}
if err == nil && te != nil {
req.ClientTokenAccessor = te.Accessor

8
vault/wrapping.go
View File

@ -333,8 +333,12 @@ func (c *Core) ValidateWrappingToken(ctx context.Context, req *logical.Request)
}
// Check for it being a JWT. If it is, and it is valid, we extract the
// internal client token from it and use that during lookup.
if strings.Count(token, ".") == 2 {
// internal client token from it and use that during lookup. The second
// check is a quick check to verify that we don't consider a namespaced
// token to be a JWT -- namespaced tokens have two dots too, but Vault
// token types (for now at least) begin with a letter representing a type
// and then a dot.
if strings.Count(token, ".") == 2 && token[1] != '.' {
// Implement the jose library way
parsedJWT, err := squarejwt.ParseSigned(token)
if err != nil {