ansible/awx

Add PS256 and EdDSA signature algorithms to AWX when using OIDC

開放

#15,127 建立於 2024年4月22日

 (0 則留言) (2 個反應) (0 位負責人)Python (3,333 個分叉)batch import
communityhelp wantedtype:enhancement

倉庫指標

星標
 (13,071 顆星)
PR 合併指標
 (平均合併 24天 6小時) (30 天內合併 30 個 PR)

描述

Please confirm the following

  • I agree to follow this project's code of conduct.
  • I have checked the current issues for duplicates.
  • I understand that AWX is open source software provided for free and that I might not receive a timely response.

Feature type

New Feature

Feature Summary

Logging in using OIDC is successful when RS256 is set on the IDP (keycloak in my case), but unsuccessful when PS256 or EdDSA is set.

"Use EdDSA where possible and use ECDSA when it is not. If you are forced to use RSA, prefer RSASSA-PSS [PS256] over RSASSA-PKCS1-v1_5 [RS256]" (quoted from “JWTs: Which Signing Algorithm Should I Use?”).

Select the relevant components

  • UI
  • API
  • Docs
  • Collection
  • CLI
  • Other

Steps to reproduce

  • Set PS256 or EdDSA as the signature algorithm on the IDP side such as keycloak
  • configure OIDC settings on AWX pointing to that IDP
  • login with OIDC

Current results

Login is unsuccessful

Sugested feature result

stronger security

Additional information

  • OpenBanking has already made the transition to PS256 since 03/2019
  • Australian infosec has a requirement for PS256 since 2019

貢獻者指南