From 1b43f5f9fb9f38029e1b692c9b41d0bf99c96321 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Tue, 7 Jun 2022 13:54:37 -0400 Subject: [PATCH 1/2] updates deps and changelog --- CHANGELOG.md | 31 +++++++++++++++++++++++++++++++ go.mod | 2 +- go.sum | 2 ++ 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f976ca1b6..fd0f95887 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## What's New - Edge + - Breaking Changes - Bug fixes - Fabric - Bug fixes @@ -11,6 +12,36 @@ - N/A # Edge +## Breaking Changes + +The following Edge Management REST API Endpoints have breaking changes: + +- `POST /ext-jwt-signers` + - `kid` is required if `certPem` is specified + - `jwtEndpoint` or `certPem` is required + - `issuer` is now required + - `audience` is now required +- `PUT /ext-jwt-signers` - `kid` is required if `certPem` is specified, `issuer` is required, `audience` is required + - `kid` is required if `certPem` is specified + - `jwtEndpoint` or `certPem` is required + - `issuer` is now required + - `audience` is now required +- `PATCH /ext-jwt-signers` - `kid` is required if `certPem` is specified, `issuer` is required, `audience` is required + - `kid` is required if `certPem` is set and `kid` was not previously set + - `jwtEndpoint` or `certPem` must be defined or previously set of the other is `null` + - `issuer` may not be set to `null` or `""` + - `audience` may not be set to `null` or `""` + +The above changes will render existing `ext-jwt-signers` as always failing authentication is `issuer` and `audience` +were not previously set. + +## JWKS Support + +`ext-jwt-signers` now support `jwksEndpoint` which is a URL that resolves to a service that returns a JWKS JSON payload. +When specified, the `certPem` and `kid` files are no longer required. Additionally, when a JWT `iss` fields matches +an existing `extj-jwt-signers`'s `issuer` field and the `kid` is currently unknown, the `jwksEndpoint` will be +interrogated for new signing keys. The `jwksEndpoint` will only resolve at most once every five seconds. + ## Bug Fixes * https://github.com/openziti/edge/issues/1027 diff --git a/go.mod b/go.mod index 3e7044c25..31bda82a9 100644 --- a/go.mod +++ b/go.mod @@ -23,7 +23,7 @@ require ( github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19 github.com/michaelquigley/pfxlog v0.6.9 github.com/openziti/channel v0.18.39 - github.com/openziti/edge v0.21.240 + github.com/openziti/edge v0.21.241 github.com/openziti/fabric v0.18.1 github.com/openziti/foundation v0.17.27 github.com/openziti/sdk-golang v0.16.76 diff --git a/go.sum b/go.sum index c6a9a9a9b..c62a6066d 100644 --- a/go.sum +++ b/go.sum @@ -670,6 +670,8 @@ github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAP github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= github.com/openziti/edge v0.21.240 h1:fZel8XqljutdnquD1niDKLzbo747eN7d3QYLB6ZeFPM= github.com/openziti/edge v0.21.240/go.mod h1:Y020IcBM3Wbo/h4LJQkpq91BXCFx5SnT/DZO/zSuQ+U= +github.com/openziti/edge v0.21.241 h1:5RkyTzxCN1t91WMvDpa5hWfjfWZNt6MXx3GTCwqYMPY= +github.com/openziti/edge v0.21.241/go.mod h1:fgdBJiDCqTnGehmAC6OuEGCWGdoBv2sBkb67N3aJ7yg= github.com/openziti/fabric v0.18.1 h1:ftZUBy9DwM8JEI1Z1wjfgkDuXEAoGAE9gXUrG8R71Qw= github.com/openziti/fabric v0.18.1/go.mod h1:Nr4nM6TfL1EsQoPEismBEErmz15miIngR9rCgkG8j0k= github.com/openziti/foundation v0.17.27 h1:RKvHQHNIxfME0LnxB+LF14HS19V+wE3NvSse0G5fnAE= From e7a6f948f9fd08c4684aa01db2bf9d8bfd821e06 Mon Sep 17 00:00:00 2001 From: Andrew Martinez Date: Tue, 7 Jun 2022 14:12:01 -0400 Subject: [PATCH 2/2] go mod tidy --- go.mod | 1 + go.sum | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 31bda82a9..b9dea5b30 100644 --- a/go.mod +++ b/go.mod @@ -129,6 +129,7 @@ require ( github.com/oklog/ulid v1.3.1 // indirect github.com/opentracing/opentracing-go v1.2.0 // indirect github.com/openziti/dilithium v0.3.3 // indirect + github.com/openziti/jwks v1.0.1 // indirect github.com/openziti/x509-claims v1.0.2 // indirect github.com/openziti/xweb/v2 v2.0.0 // indirect github.com/orcaman/concurrent-map/v2 v2.0.0 // indirect diff --git a/go.sum b/go.sum index c62a6066d..08294e9b3 100644 --- a/go.sum +++ b/go.sum @@ -668,14 +668,14 @@ github.com/openziti/channel v0.18.39 h1:6VNSs4awqem2s0MXe1P/PlmwyOUqSIVhQqsnS1ot github.com/openziti/channel v0.18.39/go.mod h1:fO3m1xHXFM1dqtcR3IienQjiNJV4i5kzdqr0eWSncJE= github.com/openziti/dilithium v0.3.3 h1:PLgQ6PMNLSTzCFbX/h98cmudgz/cU6TmjdSv5NAPD8k= github.com/openziti/dilithium v0.3.3/go.mod h1:vsCjI2AU/hon9e+dLhUFbCNGesJDj2ASgkySOcpmvjo= -github.com/openziti/edge v0.21.240 h1:fZel8XqljutdnquD1niDKLzbo747eN7d3QYLB6ZeFPM= -github.com/openziti/edge v0.21.240/go.mod h1:Y020IcBM3Wbo/h4LJQkpq91BXCFx5SnT/DZO/zSuQ+U= github.com/openziti/edge v0.21.241 h1:5RkyTzxCN1t91WMvDpa5hWfjfWZNt6MXx3GTCwqYMPY= github.com/openziti/edge v0.21.241/go.mod h1:fgdBJiDCqTnGehmAC6OuEGCWGdoBv2sBkb67N3aJ7yg= github.com/openziti/fabric v0.18.1 h1:ftZUBy9DwM8JEI1Z1wjfgkDuXEAoGAE9gXUrG8R71Qw= github.com/openziti/fabric v0.18.1/go.mod h1:Nr4nM6TfL1EsQoPEismBEErmz15miIngR9rCgkG8j0k= github.com/openziti/foundation v0.17.27 h1:RKvHQHNIxfME0LnxB+LF14HS19V+wE3NvSse0G5fnAE= github.com/openziti/foundation v0.17.27/go.mod h1:obk269ZljgJzdziLAHcoAW+otWSqGYH57XupgkiIsj0= +github.com/openziti/jwks v1.0.1 h1:+BtBzDWFVUlJfCbBhQR0BZI3YNtoBvfhfdCUSSB0G+0= +github.com/openziti/jwks v1.0.1/go.mod h1:KwO0x9FBG0aoJS5f6nH5xeHoplyR1H143SMI9kF0mC8= github.com/openziti/sdk-golang v0.16.76 h1:/RuuZQGnGNuLBgFuW17t903s1EKh7TPn9ysm6tEuKIo= github.com/openziti/sdk-golang v0.16.76/go.mod h1:YsuGyHDMJh0UdPHAQUOB1OHV3c+xkwYs5JoYK/vPJiI= github.com/openziti/storage v0.1.7 h1:g8iBcscDF+EzgGYDm9MKNRKK3xuS1AWPe9dMLJHN32U=