Skip to content

Commit a069de8

Browse files
doebrowskdoebrowsk
authored
Merge pull request #39 from Keyfactor/feat/AB#68671/jwt-token-from-oauth-credentials-2
Use Google Identity Server to Generate JWT for Ambient Credentials
2 parents fe79ea2 + 2ca87ba commit a069de8

File tree

13 files changed

+182
-27
lines changed

13 files changed

+182
-27
lines changed

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,9 @@
4242

4343
## Fixes
4444
- Bug fix in Helm chart release action
45+
46+
# v2.1.0
47+
48+
## Fixes
49+
- Updated library golang.org/x/crypto to version v0.33.0 to address authorization bypass vulnerability (https://github.com/advisories/GHSA-v778-237x-gjrc)
50+
- Bug fix for Google ambient credentials

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
289289
| certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` |
290290
| certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. |
291291
| certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. |
292+
| scopes | (Optional) If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. |
293+
| audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. |
292294
293295
> If a different combination of hostname/certificate authority/certificate template is required, a new Issuer or ClusterIssuer resource must be created. Each resource instantiation represents a single configuration.
294296
@@ -314,6 +316,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
314316
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
315317
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
316318
certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
319+
# scopes: "openid email https://example.com/.default" # Uncomment if desired
320+
# audience: "https://your-command-url.com" # Uncomment if desired
317321
EOF
318322
319323
kubectl -n default apply -f issuer.yaml
@@ -338,6 +342,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
338342
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
339343
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
340344
certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
345+
# scopes: "openid email https://example.com/.default" # Uncomment if desired
346+
# audience: "https://your-command-url.com" # Uncomment if desired
341347
EOF
342348
343349
kubectl apply -f clusterissuer.yaml

‎api/v1alpha1/issuer_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,14 @@ type IssuerSpec struct {
8181
// effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8282
// +optional
8383
Scopes string `json:"scopes,omitempty"`
84+
85+
// The audience value used when requesting a Bearer token from an ambient token provider implied
86+
// by the environment, rather than by commandSecretName. For example, could be set to
87+
// https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
88+
// the URL of your Command environment.Has no effect on OAuth 2.0 Client Credential configuration - please specify
89+
// the audience for this method in an Opaque secret.
90+
// +optional
91+
Audience string `json:"audience,omitempty"`
8492
}
8593

8694
func (i *Issuer) GetStatus() *IssuerStatus {

‎config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,14 @@ spec:
4444
description: APIPath is the base path of the Command API. KeyfactorAPI
4545
by default
4646
type: string
47+
audience:
48+
description: |-
49+
The audience value used when requesting a Bearer token from an ambient token provider implied
50+
by the environment, rather than by commandSecretName. For example, could be set to
51+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
52+
the URL of your Command environment.Has no effect on OAuth 2.0 Client Credential configuration - please specify
53+
the audience for this method in an Opaque secret.
54+
type: string
4755
caSecretName:
4856
description: |-
4957
The name of the secret containing the CA bundle to use when verifying

‎config/crd/bases/command-issuer.keyfactor.com_issuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,14 @@ spec:
4444
description: APIPath is the base path of the Command API. KeyfactorAPI
4545
by default
4646
type: string
47+
audience:
48+
description: |-
49+
The audience value used when requesting a Bearer token from an ambient token provider implied
50+
by the environment, rather than by commandSecretName. For example, could be set to
51+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
52+
the URL of your Command environment.Has no effect on OAuth 2.0 Client Credential configuration - please specify
53+
the audience for this method in an Opaque secret.
54+
type: string
4755
caSecretName:
4856
description: |-
4957
The name of the secret containing the CA bundle to use when verifying

‎deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,14 @@ spec:
8787
api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no
8888
effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8989
type: string
90+
audience:
91+
description: |-
92+
The audience value used when requesting a Bearer token from an ambient token provider implied
93+
by the environment, rather than by commandSecretName. For example, could be set to
94+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
95+
the URL of your Command environment. Has no effect on OAuth 2.0 Client Credential configuration - please specify
96+
the audience for this method in an Opaque secret.
97+
type: string
9098
type: object
9199
status:
92100
description: IssuerStatus defines the observed state of Issuer

‎deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,14 @@ spec:
8787
api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no
8888
effect on OAuth 2.0 Client Credential configuration - please specify the scopes for this method in an Opaque secret.
8989
type: string
90+
audience:
91+
description: |-
92+
The audience value used when requesting a Bearer token from an ambient token provider implied
93+
by the environment, rather than by commandSecretName. For example, could be set to
94+
https://example.com when requesting an access token from Google's identity token provider. Ideally, this should be
95+
the URL of your Command environment. Has no effect on OAuth 2.0 Client Credential configuration - please specify
96+
the audience for this method in an Opaque secret.
97+
type: string
9098
type: object
9199
status:
92100
description: IssuerStatus defines the observed state of Issuer

‎docsource/content.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
256256
| certificateAuthorityLogicalName | The logical name of the Certificate Authority to use in Command. For example, `Sub-CA` |
257257
| certificateAuthorityHostname | (optional) The hostname of the Certificate Authority specified by `certificateAuthorityLogicalName`. This field is usually only required if the CA in Command is a DCOM (MSCA-like) CA. |
258258
| certificateTemplate | The Short Name of the Certificate Template to use when this Issuer/ClusterIssuer enrolls CSRs. |
259+
| scopes | (Optional) If using ambient credentials, these scopes will be put on the access token generated by the ambient credentials' token provider, if applicable. |
260+
| audience | (Optional) If using ambient credentials, this audience will be put on the access token generated by the ambient credentials' token provider, if applicable. Google's ambient credential token provider generates an OIDC ID Token. If this value is not provided, it will default to `command`. |
259261
260262
> If a different combination of hostname/certificate authority/certificate template is required, a new Issuer or ClusterIssuer resource must be created. Each resource instantiation represents a single configuration.
261263
@@ -281,6 +283,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
281283
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
282284
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
283285
certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
286+
# scopes: "openid email https://example.com/.default" # Uncomment if desired
287+
# audience: "https://your-command-url.com" # Uncomment if desired
284288
EOF
285289
286290
kubectl -n default apply -f issuer.yaml
@@ -305,6 +309,8 @@ For example, ClusterIssuer resources can be used to issue certificates for resou
305309
# certificateAuthorityHostname: "$COMMAND_CA_HOSTNAME" # Uncomment if required
306310
certificateAuthorityLogicalName: "$COMMAND_CA_LOGICAL_NAME"
307311
certificateTemplate: "$CERTIFICATE_TEMPLATE_SHORT_NAME"
312+
# scopes: "openid email https://example.com/.default" # Uncomment if desired
313+
# audience: "https://your-command-url.com" # Uncomment if desired
308314
EOF
309315
310316
kubectl apply -f clusterissuer.yaml

‎go.mod‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ require (
88
github.com/cert-manager/cert-manager v1.16.2
99
github.com/go-logr/logr v1.4.2
1010
github.com/stretchr/testify v1.10.0
11-
golang.org/x/oauth2 v0.24.0
11+
golang.org/x/oauth2 v0.26.0
1212
k8s.io/api v0.31.1
1313
k8s.io/apimachinery v0.31.1
1414
k8s.io/client-go v0.31.1
@@ -17,7 +17,24 @@ require (
1717
)
1818

1919
require (
20-
cloud.google.com/go/compute/metadata v0.5.1 // indirect
20+
cloud.google.com/go/auth v0.15.0 // indirect
21+
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
22+
github.com/felixge/httpsnoop v1.0.4 // indirect
23+
github.com/go-logr/stdr v1.2.2 // indirect
24+
github.com/google/s2a-go v0.1.9 // indirect
25+
github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
26+
github.com/googleapis/gax-go/v2 v2.14.1 // indirect
27+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
28+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
29+
go.opentelemetry.io/otel v1.34.0 // indirect
30+
go.opentelemetry.io/otel/metric v1.34.0 // indirect
31+
go.opentelemetry.io/otel/trace v1.34.0 // indirect
32+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
33+
google.golang.org/grpc v1.70.0 // indirect
34+
)
35+
36+
require (
37+
cloud.google.com/go/compute/metadata v0.6.0 // indirect
2138
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 // indirect
2239
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0 // indirect
2340
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
@@ -45,7 +62,7 @@ require (
4562
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4663
github.com/golang/protobuf v1.5.4 // indirect
4764
github.com/google/gnostic-models v0.6.8 // indirect
48-
github.com/google/go-cmp v0.6.0 // indirect
65+
github.com/google/go-cmp v0.7.0 // indirect
4966
github.com/google/gofuzz v1.2.0 // indirect
5067
github.com/google/uuid v1.6.0 // indirect
5168
github.com/hashicorp/go-hclog v1.5.0 // indirect
@@ -76,15 +93,16 @@ require (
7693
go.mozilla.org/pkcs7 v0.9.0 // indirect
7794
go.uber.org/multierr v1.11.0 // indirect
7895
go.uber.org/zap v1.27.0 // indirect
79-
golang.org/x/crypto v0.30.0 // indirect
96+
golang.org/x/crypto v0.33.0 // indirect
8097
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
81-
golang.org/x/net v0.32.0 // indirect
82-
golang.org/x/sys v0.28.0 // indirect
83-
golang.org/x/term v0.27.0 // indirect
84-
golang.org/x/text v0.21.0 // indirect
85-
golang.org/x/time v0.6.0 // indirect
98+
golang.org/x/net v0.35.0 // indirect
99+
golang.org/x/sys v0.30.0 // indirect
100+
golang.org/x/term v0.29.0 // indirect
101+
golang.org/x/text v0.22.0 // indirect
102+
golang.org/x/time v0.10.0 // indirect
86103
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
87-
google.golang.org/protobuf v1.34.2 // indirect
104+
google.golang.org/api v0.223.0
105+
google.golang.org/protobuf v1.36.5 // indirect
88106
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
89107
gopkg.in/inf.v0 v0.9.1 // indirect
90108
gopkg.in/yaml.v2 v2.4.0 // indirect

0 commit comments

Comments
 (0)