Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upSupport authentication using a JSON web token (JWT) #93 #100
Conversation
* Created new configuration section for JWT Auth - Configure a JWK to verify a JWT signature - Configure requried signature algorithms - Configure required audience and issuer claims - Configure name of username claim * Added code block in lambda_handler_user to validate JWT if configured - Require remote_usernames == bastion_user - Require valid JWT signature, expiry, and signature algorithm - Require username_claim in JWT - Require username_claim == bastion_user * Added unit tests for config and JWT validation
… hash * Pin marshmellow to a version less than 3. This might be fixed in #99 * Disable at_hash verification if present in the JWT, since the bless lambda doesn't have access to the a hash of the access token.
|
@russell-lewis am I able to get a hand reviewing this PR? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
This PR enables support for authentication with OpenIDConnect by verifying a JWT #93
A third party library (https://github.com/mpdavis/python-jose) is introduced to verify a JSON Web Token (JWT), and parse a JSON Web Key (JWK). This library was chosen because it is well maintained, a compatible license, features on jwt.io, is light weight, and can support JWKs.