From 15712b7dd1424c40b5e25ba4f4daa316612b4564 Mon Sep 17 00:00:00 2001 From: chrislusf Date: Sun, 25 Oct 2026 08:27:48 -0700 Subject: [PATCH] OIDC: document jtiReplayProtectionEnabled (managed-provider flag included) --- Kubernetes-ServiceAccount-Authentication.md | 1 + OIDC-Integration.md | 1 + 2 files changed, 2 insertions(+) diff --git a/Kubernetes-ServiceAccount-Authentication.md b/Kubernetes-ServiceAccount-Authentication.md index 20355d2..d1c5d1b 100644 --- a/Kubernetes-ServiceAccount-Authentication.md +++ b/Kubernetes-ServiceAccount-Authentication.md @@ -288,6 +288,7 @@ Scope on `oidc:sub` to pin a role to a specific ServiceAccount, or `StringLike` | **Audience matches none of the configured client IDs** | The projected token `audience` must equal the provider `clientId` (or be in `clientIds`). | | **Trust policy denies web identity assumption** | `oidc:sub` in the trust policy must match `system:serviceaccount::` exactly; for a namespace use `StringLike`. | | **Credentials expire mid-run** | Use the SDK web-identity provider (Option A) which auto-refreshes; if calling STS manually, re-assume before `Expiration`. | +| **Token accepted once, then `AssumeRoleWithWebIdentity` fails on reuse** | Since 4.50, `jti` replay protection accepts each web-identity token once; several pods sharing one projected token trip it. Set `"jtiReplayProtectionEnabled": false` in the provider `config` (Part 2) — or `jti_replay_protection_enabled` on a managed provider — for providers fronting Kubernetes workload identity | | **SDK still hits real AWS STS** | The STS endpoint override didn't take effect; set `AWS_ENDPOINT_URL_STS` or configure the STS client endpoint in code. | ## See also diff --git a/OIDC-Integration.md b/OIDC-Integration.md index fb0e2c2..63b02c3 100644 --- a/OIDC-Integration.md +++ b/OIDC-Integration.md @@ -114,6 +114,7 @@ The IAM configuration file has these main sections: | `jwksCacheTTLSeconds` | No | integer | How long to cache JWKS before refresh in seconds (default: `3600`) | | `roleMapping` | No | object | Configuration for mapping OIDC claims to SeaweedFS roles (see below) | | `claimsMapping` | No | object | Map OIDC claims to identity attributes | +| `jtiReplayProtectionEnabled` | No | boolean | Web-identity token replay protection via `jti` tracking (default: `true`). Set `false` for providers whose clients legitimately reuse one token across multiple `AssumeRoleWithWebIdentity` calls — e.g. Kubernetes projected service-account tokens shared by several pods | ### Policies