ansible/awx

Add PS256 and EdDSA signature algorithms to AWX when using OIDC

Open

#15,127 创建于 2024年4月22日

在 GitHub 查看
 (0 评论) (2 反应) (0 负责人)Python (13,071 star) (3,333 fork)batch import
communityhelp wantedtype:enhancement

描述

Please confirm the following

  • I agree to follow this project's code of conduct.
  • I have checked the current issues for duplicates.
  • I understand that AWX is open source software provided for free and that I might not receive a timely response.

Feature type

New Feature

Feature Summary

Logging in using OIDC is successful when RS256 is set on the IDP (keycloak in my case), but unsuccessful when PS256 or EdDSA is set.

"Use EdDSA where possible and use ECDSA when it is not. If you are forced to use RSA, prefer RSASSA-PSS [PS256] over RSASSA-PKCS1-v1_5 [RS256]" (quoted from “JWTs: Which Signing Algorithm Should I Use?”).

Select the relevant components

  • UI
  • API
  • Docs
  • Collection
  • CLI
  • Other

Steps to reproduce

  • Set PS256 or EdDSA as the signature algorithm on the IDP side such as keycloak
  • configure OIDC settings on AWX pointing to that IDP
  • login with OIDC

Current results

Login is unsuccessful

Sugested feature result

stronger security

Additional information

  • OpenBanking has already made the transition to PS256 since 03/2019
  • Australian infosec has a requirement for PS256 since 2019

贡献者指南

技术栈
python
领域
authenticationsecuritybackend
议题类型
feature
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
half day
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
fresh
清晰度议题是否清楚说明期望改动、验收标准和下一步。
mostly clear
前置要求
OIDC knowledgePython JWT library familiarity
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
45
研究方向
The issue requests adding support for PS256 and EdDSA JWT signature algorithms in AWX's OIDC authentication flow. To implement, locate the OIDC backend code, likely in files handling JWT verification (e.g., awx/sso/ or similar). Investigate the current algorithm support and extend it to include PS256 and EdDSA. Review linked resources like the Scott Brady article for guidance. Ensure compliance with existing authentication tests.