When using the OIDC authenticator, I noticed that the authenticator still succeeds even if we’re past the expiration time designated in the JWT.
While not doing a comprehensive validation of the JWT may be okay, it does seem strange that the authenticator doesn’t deny when the token expires - we lose a large amount of the value when it can’t be used as a ‘short lived’ access token, but continues to be valid for access indefinitely.
What I haven’t tested either is whether or not JWT token is verified as being signed by the right provider, is it?
This should definitely be added to the oidc-authn.
Do you think this should be configurable or should it be mandatory? I think this should be mandatory to validate the expiration token.
Adding this ability should look something like:
def jwt_expiration
@expiration_time ||= @id_token_attributes["exp"]
end
def current_epoch
@current_epoch = Time.now.to_i
end
def validate_jwt?
current_epoch < jwt_expiration
end
Andrew, that does seem like it should probably be mandatory since it’s a pretty important part of the specification.
Regarding who should be doing the validation - I’m not particularly savvy at Ruby so I may be reading the conjur code incorrectly. The STS flow is quite a bit different - the way the IAM authenticator works does indeed prevent it, but that’s because AWS is basically an active participant in the model Conjur uses there and isn’t really OIDC.
While I think I see the retrieval of the provider certificate in your ruby module, I’m not seeing anything around invoking theintrospection endpoint, so there wouldn’t be an opportunity for the OIDC provider to run the expiration validation as you suggest. Honestly, it’s really not worth doing the introspection (see OKTA’s comment), as it’s complexity for very little value thanks to the signed token being a good proof of identity anyway - your proposal makes a lot of sense.
OKTA does also outline best validation practices. Since Conjur isn’t really doing a full OIDC flow, the only verification beyond what you’re doing that is probably still relevant would be the iat (is in the past) and exp (is in the future). A audience check would probably be best practice, but a lot of common validators out there don’t check that anyway.
I waited longer past expiry (tried it today again with the same id token - 12 hours) and it is indeed flagging as expired. Must be a clock issue on our docker node. I had tried with it being expired ~10 minutes, and it still authenticated.
What would I enable to debug the OIDC authentication? Turns out the OIDC token isn’t usable by Conjur for the first minute of its existence right now for us, either.