mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-26 06:50:45 +01:00
Chris Lu
6dd6ad512c
* iam/oidc: drop single-use web-identity tokens and the jti replay cache Reverts the single-use semantics added in #11936 (and the #12017 refactor): AssumeRoleWithWebIdentity consumed each web-identity token's jti into a bounded replay cache, so a second exchange of the same token was rejected until exp + skew. AWS STS accepts a web-identity token repeatedly until it expires, and Kubernetes workload identity depends on that: the kubelet keeps a projected ServiceAccount token until ~80% of its lifetime, so pod restarts, co-located containers sharing the token file, repeated CLI invocations, and pre-rotation SDK refreshes all re-present the same jti and were refused on 4.50. The replay machinery also carried a real maintenance cost — a bounded concurrent cache, fingerprint-keyed entries for jti-less tokens, adopt/merge handoffs so provider rebuilds could not reopen consumed tokens, and provider-reuse bookkeeping in the refresh path that existed only to preserve that state. Removing it restores AWS semantics and deletes the whole apparatus. Refs #12063. Alternative to the per-provider opt-out in #12064. * iam: reuse unchanged OIDC providers on refresh refreshOIDCProvidersFrom rebuilt every managed provider on any store change, so an unrelated write discarded each provider's JWKS cache and an unreachable issuer could then fail exchanges the cached keys would have allowed. Keep a per-record provider cache keyed on the record content fingerprint and only rebuild when the record changes. * iam/oidc: require exp in ValidateToken Dropping the single-use check also removed the implicit bound on expiry-less tokens: a signed web-identity token without exp could mint STS sessions indefinitely. Require the exp claim, matching AWS AssumeRoleWithWebIdentity which rejects tokens without one. * iam/oidc: bound idle connections on the provider transport A provider replaced on refresh drops its http.Transport without a close; give it an IdleConnTimeout so pooled connections and their goroutines cannot linger. * s3api: cover web-identity token reuse over HTTP Sign one token and exchange that exact string twice, directly covering the Kubernetes projected-token reuse this change restores. * test(iam): refresh reuses an unchanged record's provider Covers the provider-reuse cache: an unrelated record's refresh keeps a provider's JWKS state, a changed record rebuilds it.
23 lines
955 B
Go
23 lines
955 B
Go
package providers
|
|
|
|
import "errors"
|
|
|
|
// Typed errors for identity provider operations
|
|
// These enable robust error checking with errors.Is() throughout the stack
|
|
var (
|
|
// ErrProviderTokenExpired indicates that the provided token has expired
|
|
ErrProviderTokenExpired = errors.New("provider: token has expired")
|
|
|
|
// ErrProviderInvalidToken indicates that the token format is invalid or malformed
|
|
ErrProviderInvalidToken = errors.New("provider: invalid token format")
|
|
|
|
// ErrProviderInvalidIssuer indicates that the token issuer is not trusted
|
|
ErrProviderInvalidIssuer = errors.New("provider: invalid token issuer")
|
|
|
|
// ErrProviderInvalidAudience indicates that the token audience doesn't match expected value
|
|
ErrProviderInvalidAudience = errors.New("provider: invalid token audience")
|
|
|
|
// ErrProviderMissingClaims indicates that required claims are missing from the token
|
|
ErrProviderMissingClaims = errors.New("provider: missing required claims")
|
|
)
|