-
Notifications
You must be signed in to change notification settings - Fork 124
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
AuthnJWT: support claims with hyphens #2792
Conversation
f9be98d
to
ccfc99b
Compare
cb4f0c1
to
b3b71a1
Compare
app/domain/authentication/authn_jwt/restriction_validation/validate_restrictions_one_to_one.rb
Outdated
Show resolved
Hide resolved
b3b71a1
to
3b3d947
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, although looks like it needs a fresh rebase
3b3d947
to
a19dd03
Compare
a19dd03
to
f1c09e2
Compare
f1c09e2
to
d055458
Compare
@@ -15,6 +15,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. | |||
- Update bundler to 2.2.33 to remove CVE-2021-43809 | |||
[cyberark/conjur#2804](https://github.com/cyberark/conjur/pull/2804/files) | |||
|
|||
### Fixed | |||
- AuthnJWT now supports claims that include hyphens and inline namespaces. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Lists should be surrounded by blank lines
Code Climate has analyzed commit d055458 and detected 1 issue on this pull request. Here's the issue category breakdown:
The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 89.9% (-1.5% change). View more on Code Climate. |
Failure caused by regex update in #2792
Failure caused by regex update in #2792
Failure caused by regex update in #2792
Desired Outcome
AuthnJWT uses the regex
^[a-zA-Z|$|_][a-zA-Z|$|_|0-9|.](\/[a-zA-Z|$|_][a-zA-Z|$|_|0-9|.])*$
to validate token claims, and therefore does not support claims including hyphens. An example of a claim that fails this validation is CircleCI's additional token claims:oidc.circleci.com/project-id
et al.AuthnJWT also currently does not support claims with inline namespaces (
namespace.com/claim-key
), instead digesting slash-delimited claims as nested. The CircleCI example above still applies.Implemented Changes
^[a-zA-Z|$|_][a-zA-Z|$|_|0-9|.](\/[a-zA-Z|$|_][a-zA-Z|$|_|\-|0-9|.])*$
Connected Issue/Story
ONYX-29842
Definition of Done
At least 1 todo must be completed in the sections below for the PR to be
merged.
Changelog
CHANGELOG update
Test coverage
changes, or
Documentation
README
s) were updated in this PRBehavior
Security