Bugfix/OIDC aud field check

[FracassandoCasualmente]

Related issue(s) and PR(s)

This PR closes #1639.

Description

Resolves a vulnerability where a rogue server could impersonate any user who logs into it, enabling unauthorized access to any SDA instance using LS AAI.

How to test

• Run make sda-s3-up
• Log into the rogue service at http://localhost:8802/ as a dummy user
• Get the access token from the rogue server and put it into a "token" variable in the terminal
• Run curl -H "Authorization: Bearer $token" localhost:8090/files
• Check that the api returns an error response
• Download the submission credentials file from the rogue service
• Change the "host_base" in the configuration to "http://localhost:18000"
• Run sda-cli -config s3cmd.conf list and check that the inbox returns an error response
• Repeat the same steps but by using the credentials from the real auth service at http://localhost:8801 and check that they both return a non-error response

[jbygdell]

Hi,

Thank you for your contribution.

We agree that this is something that needs addressing. Since the token authentication is used by several applications this will require changes to other parts of the code as well, mainly in the authenticator initiation and configurations. Which in turn requires changes to the helm chart and the test suite.

[FracassandoCasualmente]

Hi,

Thank you for your contribution.

We agree that this is something that needs addressing. Since the token authentication is used by several applications this will require changes to other parts of the code as well, mainly in the authenticator initiation and configurations. Which in turn requires changes to the helm chart and the test suite.

Hello!
Thanks for reply and for the corrections.

Regarding the changes that are missing, I don't really have experience with helm charts nor have broad knowledge of the code base, so it would take me some time (1+ month?) to fix.
I'm happy to take the time to handle this, especially if your team feels short-staffed or overwhelmed. However, if you think it would take too long for the change to reach production, feel free to close this PR and handle it internally. :)