Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JWT IAT predate support #549

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

JWT IAT predate support #549

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c6158a
Introduce jwt Issued At
spdracers Feb 12, 2024
da8ea01
Corrected IAT and added explicit value for the mock test
spdracers Feb 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ with:

You can configure trust between your own OIDC Provider and Vault
with the JWT auth method. Provide a `role` & `jwtPrivateKey` parameters,
additionally you can pass `jwtKeyPassword` & `jwtTtl` parameters
additionally you can pass `jwtKeyPassword`, `jwtTtl`, & `jwtIat` parameters.

```yaml
with:
Expand All @@ -243,6 +243,7 @@ with:
jwtPrivateKey: ${{ secrets.JWT_PRIVATE_KEY }}
jwtKeyPassword: ${{ secrets.JWT_KEY_PASS }}
jwtTtl: 3600 # 1 hour, default value
jwtIat: 60 # 1 min, default value. Negative int postdates
```

### Kubernetes
Expand Down
4 changes: 4 additions & 0 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,10 @@ inputs:
description: 'Time in seconds, after which token expires'
required: false
default: 3600
jwtIat:
description: 'Number of seconds (int) to predate the token issued at (iat).'
required: false
default: 60
secretEncodingType:
description: 'The encoding type of the secret to decode. If not specified, the secret will not be decoded. Supported values: base64, hex, utf8'
required: false
Expand Down
2 changes: 1 addition & 1 deletion integrationTests/basic/jwt_auth.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ function mockGithubOIDCResponse(aud= "https://github.com/hashicorp/vault-action"
ref_type: "branch",
job_workflow_ref: "hashicorp/vault-action/.github/workflows/workflow.yml@refs/heads/main",
iss: 'vault-action',
iat: now,
iat: now - 60,
nbf: now,
exp: now + 3600,
};
Expand Down
8 changes: 5 additions & 3 deletions src/auth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,13 @@ async function retrieveToken(method, client) {
const privateKey = Buffer.from(privateKeyRaw, 'base64').toString();
const keyPassword = core.getInput('jwtKeyPassword', { required: false });
const tokenTtl = core.getInput('jwtTtl', { required: false }) || '3600'; // 1 hour
const tokenIat = core.getInput('jwtIat', { required: false }) || '60';
const githubAudience = core.getInput('jwtGithubAudience', { required: false });

if (!privateKey) {
jwt = await core.getIDToken(githubAudience)
} else {
jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl));
jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl), Number(tokenIat));
}

return await getClientToken(client, method, path, { jwt: jwt, role: role });
Expand Down Expand Up @@ -79,14 +80,15 @@ async function retrieveToken(method, client) {
* @param {string} privateKey
* @param {string} keyPassword
* @param {number} ttl
* @param {number} iat
*/
function generateJwt(privateKey, keyPassword, ttl) {
function generateJwt(privateKey, keyPassword, ttl, iat) {
const alg = 'RS256';
const header = { alg: alg, typ: 'JWT' };
const now = rsasign.KJUR.jws.IntDate.getNow();
const payload = {
iss: 'vault-action',
iat: now,
iat: now - iat,
nbf: now,
exp: now + ttl,
event: process.env.GITHUB_EVENT_NAME,
Expand Down