JWT issuer validation #6175

maxtropets · 2024-05-10T16:52:26Z

Eventually closes

Decided to merge together to avoid being split into different releases

src/endpoints/authentication/jwt_auth.cpp

include/ccf/service/tables/jwt.h

maxtropets · 2024-05-28T10:19:49Z

As noted above, kept the old tables but moved them under "Legacy" namespace. We can work with them if needed but kept them explicitly obsolete.

maxtropets · 2024-05-28T10:47:25Z

Converted back to "Draft" to include #5177 and #6204

Do not allow issuers to provide keys with mismatching constraints. Thus, issuers with a particular domain should specify key iss token constraints for that domain.

eddyashton

Partial review - need to take another look at the C++ changes.

eddyashton · 2024-05-29T16:21:35Z

tests/jwt_test.py

+    service_keys = get_jwt_keys(args, primary)
+    assert service_keys["kid1"]["issuers"][issuer.name] == issuer.name
+
+    keys["keys"][0]["issuer"] = "https://issuer.com"


Can you add a comment or brief LOG.info explaining this line? It looks like it's setting a permitted constraint (in contrast to the later garbage constraints), but its not obvious to me why we're setting this nested field directly.

eddyashton · 2024-05-29T16:24:22Z

tests/jwt_test.py

+                pass
+            else:
+                assert False, f"Constraint {constraint} must not be allowed"
+


Suggested change

network.consortium.remove_jwt_issuer(primary, issuer.name)

The other tests remove their temporary issuer to clean up the network before closing - should this do the same?

eddyashton · 2024-05-29T16:26:36Z

tests/js-custom-authorization/custom_authorization.py

+
+def try_auth(primary, issuer, kid, iss, tid):
+    with primary.client("user0") as c:
+        LOG.info("Calling JWT with kid from issuer for tenant")


Suggested change

LOG.info("Calling JWT with kid from issuer for tenant")

LOG.info(f"Creating JWT with kid={kid} from issuer={iss} for tenant={tid}")

eddyashton · 2024-05-29T16:29:25Z

tests/js-custom-authorization/custom_authorization.py

+    COMMNON_ISSUER = "https://login.microsoftonline.com/{tenantid}/v2.0"
+    TENANT_ID = "9188050d-6c67-4c5b-b112-36a304b66da"
+    ISSUER_TENANT = f"https://login.microsoftonline.com/{TENANT_ID}/v2.0"
+    ANOTHER_TENANT_ID = "ANOTHER-6c67-4c5b-b112-36a304b66da"


Suggested change

ANOTHER_TENANT_ID = "ANOTHER-6c67-4c5b-b112-36a304b66da"

ANOTHER_TENANT_ID = "aaaaaaa-6c67-4c5b-b112-36a304b66da"

Nit: Although we treat these as strings for now, they're really GUIDs - we should use a string of the right shape so that it will still work if we add more validation later. Hopefully it's clear that this is still an invalid/constructed GUID.

eddyashton · 2024-05-29T16:31:03Z

tests/js-custom-authorization/custom_authorization.py

+    with tempfile.NamedTemporaryFile(prefix="ccf", mode="w+") as metadata_fp:
+        jwt_cert_der = infra.crypto.cert_pem_to_der(issuer.cert_pem)
+        der_b64 = base64.b64encode(jwt_cert_der).decode("ascii")
+        data = {
+            "issuer": issuer.issuer_url,
+            "auto_refresh": False,
+            "jwks": {
+                "keys": [
+                    {
+                        "kty": "RSA",
+                        "kid": jwt_kid,
+                        "x5c": [der_b64],
+                        "issuer": ISSUER_TENANT,
+                    }
+                ]
+            },
+        }
+        json.dump(data, metadata_fp)
+        metadata_fp.flush()
+        network.consortium.set_jwt_issuer(primary, metadata_fp.name)


We do this block several times - can we pull it out to a helper function?

eddyashton · 2024-05-30T08:52:12Z

src/endpoints/authentication/jwt_auth.cpp

+  bool validate_issuer(
+    const http::JwtVerifier::Token& token, std::string issuer)
+  {
+    LOG_INFO_FMT(


Suggested change

LOG_INFO_FMT(

if (!token.payload_typed.tid.has_value())

{

return false;

}

LOG_INFO_FMT(

We check this condition at line 50, and in the return statement. I think we can just early-out here if there's no tenant ID specified, and simplify the later conditions?

Ah I guess this would need to go after the is_microsoft_entra check? I'll keep reading and work out how tid is populated.

eddyashton · 2024-05-30T09:03:40Z

src/node/rpc/jwt_management.h

+    // limited.facebok.com
+    //        .facebok.com


Suggested change

// limited.facebok.com

// .facebok.com

// limited.facebook.com

// .facebook.com

eddyashton · 2024-05-30T09:08:18Z

src/node/rpc/jwt_management.h

+      const auto start_seek =
+        issuer_domain.size() - (constraint_domain.size() + 1);
+      const auto count_seek = constraint_domain.size() + 1;
+      const auto pattern = "." + constraint_domain;
+
+      return start_seek > 0 // at least one letter preceeds .issuer.domain
+        && issuer_domain.substr(start_seek, count_seek) == pattern;


Could this be replaced with ends_with()?

Suggested change

const auto start_seek =

issuer_domain.size() - (constraint_domain.size() + 1);

const auto count_seek = constraint_domain.size() + 1;

const auto pattern = "." + constraint_domain;

return start_seek > 0 // at least one letter preceeds .issuer.domain

&& issuer_domain.substr(start_seek, count_seek) == pattern;

return issuer_domain.ends_with("." + constraint_domain);

eddyashton · 2024-05-30T09:10:09Z

src/node/rpc/jwt_management.h

-    auto keys = tx.rw<JwtPublicSigningKeys>(Tables::JWT_PUBLIC_SIGNING_KEYS);
-    auto key_issuer =
-      tx.rw<JwtPublicSigningKeyIssuer>(Tables::JWT_PUBLIC_SIGNING_KEY_ISSUER);
+    auto keys =


I think we should keep the original code as well here, to remove entries from the Legacy tables.

The reason we don't delete anything (here and in other places where you've commented) from the old tables in this revision is partially described here

#6175 (comment)

Example. Nodes=[A,B,C]

A->A' (upgrades)
A becomes / remains a leader
A fetches new keys and deletes them from both table revisions
A goes down
B becomes a leader

Now, if we clean both old issuers+certs, we just stop authenticating. If we leave kids only - we can't serve remove/set keys properly because kids and issuers went async.

We could've only introduced new issuers table, however we did introduce both new certs (matches the previous schema) and new issuers.

The reason for that was to keep issuers+cert synced for both prev/new code, and to support the scenario described above.

Cool, I understand and agree now - not worth peppering any remove() calls to legacy tables throughout the current code, because we don't want to try and precisely match the old write semantics. Instead we will deal with the old legacy state by adding a clear() call to the legacy tables, in a future release.

eddyashton · 2024-05-30T09:11:30Z

src/node/rpc/jwt_management.h

+          value.constraint = it->second;
+        }
+
+        LOG_INFO_FMT(


Suggested change

LOG_INFO_FMT(

LOG_DEBUG_FMT(

I think INFO is too verbose for this, and will lead to a lot of logging spam in the output.

src/node/rpc/jwt_management.h

eddyashton · 2024-05-30T09:22:33Z

src/endpoints/authentication/jwt_auth.cpp

          else
          {
            auto identity = std::make_unique<JwtAuthnIdentity>();
-            identity->key_issuer = key_issuers->get(key_id).value();
+            identity->key_issuer = validated_issuer;


We never use the Legacy::JWT_PUBLIC_SIGNING_KEY_ISSUER table, which means (if I'm reading right) that this validated_issuer string will still be empty, if issuers is empty and we went through the fallback_keys path? Can we add a path in the fallback case above, something like:

if (!issuers) { auto fallback_issuer = tx.ro<...>(ccf::Tables::Legacy::JWT_PUBLIC_SIGNING_KEY_ISSUER); validated_issuer = fallback_issuer->get(key_id).value_or({}); }

Or maybe we set issuers to a single-entry vector containing the value from the legacy map, and go through this validation path? Whatever makes sense, but I think we should try harder to use the fallback values if we're doing any fallback handling here.

maxtropets changed the title ~~WIP~~ WIP: JWT issuer validation May 10, 2024

maxtropets force-pushed the f/5809-jwt-issuer-policy-check branch 4 times, most recently from c5c28c9 to b656996 Compare May 21, 2024 14:47

maxtropets force-pushed the f/5809-jwt-issuer-policy-check branch 3 times, most recently from 8d2f033 to ff4e113 Compare May 23, 2024 12:29

maxtropets mentioned this pull request May 23, 2024

JwtAuthnPolicy could validate the key_issuer against iss #5809

Open

maxtropets changed the title ~~WIP: JWT issuer validation~~ JWT issuer validation May 23, 2024

maxtropets self-assigned this May 23, 2024

maxtropets requested review from achamayou and eddyashton and removed request for achamayou and eddyashton May 23, 2024 13:10

maxtropets marked this pull request as ready for review May 23, 2024 13:11

maxtropets requested a review from a team as a code owner May 23, 2024 13:11

maxtropets commented May 23, 2024

View reviewed changes

src/endpoints/authentication/jwt_auth.cpp Outdated Show resolved Hide resolved

include/ccf/service/tables/jwt.h Show resolved Hide resolved

maxtropets force-pushed the f/5809-jwt-issuer-policy-check branch 2 times, most recently from b2bc164 to a66369a Compare May 28, 2024 10:18

maxtropets marked this pull request as draft May 28, 2024 10:46

maxtropets force-pushed the f/5809-jwt-issuer-policy-check branch from 180e94a to 4c1885e Compare May 29, 2024 12:40

maxtropets added 2 commits May 29, 2024 12:42

Add issuer check to JWT authorization

eb15ab2

Support multiple kids for different issuers

ade5c80

maxtropets force-pushed the f/5809-jwt-issuer-policy-check branch 2 times, most recently from 66dcd1e to a5d6e0b Compare May 29, 2024 15:47

maxtropets marked this pull request as ready for review May 29, 2024 16:04

Implement domain check on key fetch

0097276

Do not allow issuers to provide keys with mismatching constraints. Thus, issuers with a particular domain should specify key iss token constraints for that domain.

maxtropets force-pushed the f/5809-jwt-issuer-policy-check branch from a5d6e0b to 0097276 Compare May 29, 2024 16:10

eddyashton reviewed May 29, 2024

View reviewed changes

eddyashton reviewed May 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

JWT issuer validation #6175

JWT issuer validation #6175

maxtropets commented May 10, 2024 •

edited

maxtropets commented May 28, 2024

maxtropets commented May 28, 2024

eddyashton left a comment

eddyashton May 29, 2024

eddyashton May 29, 2024

eddyashton May 29, 2024

eddyashton May 29, 2024

eddyashton May 29, 2024

eddyashton May 30, 2024

eddyashton May 30, 2024

eddyashton May 30, 2024

eddyashton May 30, 2024

eddyashton May 30, 2024

maxtropets May 30, 2024

eddyashton May 30, 2024

eddyashton May 30, 2024

eddyashton May 30, 2024

	LOG.info("Calling JWT with kid from issuer for tenant")
	LOG.info(f"Creating JWT with kid={kid} from issuer={iss} for tenant={tid}")

	ANOTHER_TENANT_ID = "ANOTHER-6c67-4c5b-b112-36a304b66da"
	ANOTHER_TENANT_ID = "aaaaaaa-6c67-4c5b-b112-36a304b66da"

JWT issuer validation #6175

Are you sure you want to change the base?

JWT issuer validation #6175

Conversation

maxtropets commented May 10, 2024 • edited

maxtropets commented May 28, 2024

maxtropets commented May 28, 2024

eddyashton left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxtropets commented May 10, 2024 •

edited