Repository navigation
Conversation
`AwsBackendAuth` reads an optional `oidc_audience` backend option and mints the web-identity JWT with that `aud` instead of the provider-wide default, then strips the option like `oidc_subject`. `OidcCredentialProvider::get_credentials_with_audience` is the underlying call; `get_credentials` keeps its signature and uses the default. The credential cache key now includes the audience as well as the subject. A cloud checks `aud` against the client IDs registered for the issuer before evaluating any trust policy, so a credential minted under one audience must not be served for an exchange under another. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XR9ZJnpPSJFK6LFSBxePNE
|
🚀 Latest commit deployed to https://multistore-proxy-pr-167.development-seed.workers.dev
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AwsBackendAuthreads an optionaloidc_audiencebackend option and mints the web-identity JWT with thataudinstead of the provider-wide audience given toOidcCredentialProvider::new. The option is stripped from the resolved backend options, asoidc_subjectalready is. Buckets that don't set it behave exactly as before.The new
OidcCredentialProvider::get_credentials_with_audiencedoes the work;get_credentialskeeps its signature and passes the default audience, so existing callers are unaffected.The credential cache key now includes the audience alongside the subject. AWS checks
audagainst the client IDs registered on the IAM OIDC provider before it evaluates the role's trust policy, so two exchanges that differ only in audience are not interchangeable, and a credential minted under one must not be served for the other. Keying on the audience outright is simpler than relying on it being derivable from the subject.This lets a gateway give each backend its own audience, so a role owner can register exactly that audience on their OIDC provider and have STS reject tokens minted for any other backend before policy evaluation, rather than depending on a
subcondition in the trust policy.Testing
cargo test -p multistore-oidc-provider: 42 passed, including two new tests:oidc_audience_sets_aud_and_is_stripped(decodes theWebIdentityTokensent to STS and checksaud, with and without the option) andaudiences_do_not_share_cached_credentials(same role and subject, a second audience triggers a second STS exchange).cargo clippy -p multistore-oidc-provider --all-targets -- -D warnings: clean.🤖 Generated with Claude Code