hashicorp / hashicorp/vault-plugin-auth-jwt
Adding support for acr_values configuration of oidc
- Dominant language
- Go
- Stars
- 107
- Forks
- 73
- Avg merge
- 13h 49m
- Merged PRs (30d)
- 7
Description
The oidc specification details the use of ACR Values that can optionally be provided for an auth request.
* https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
This is often coupled with specifying critical requirements to the auth process, like the use of MFA.
* https://developer.okta.com/docs/guides/step-up-authentication/main/
There have been periodic questions in the community about the availability of this feature:
* https://discuss.hashicorp.com/t/acr-values-support-with-oidc-provider-configuration/11826/2
* https://discuss.hashicorp.com/t/mfa-with-oidc-auth-configuration-of-authorization-oauth2-acr-values-xxyyzz/21628
After reviewing the code and following up the code-path laid out by eliasp in the second discussion, it is not too complicated to enable the use of the already existing feature within the [hashicorp/cap](https://pkg.go.dev/github.com/hashicorp/cap@v0.4.1/oidc#WithACRValues) package, internally used by this plugin, it only requires handling the more or less trivial configuration field, the heavy lifting is already implemented.
I am opening this issue to propose a PR with the mentioned feature and coordinate any possible feedback / recommendation / modification requirements.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the OIDC authorization-request configuration and the existing hashicorp/cap oidc.WithACRValues entry point referenced in the issue. Add the configuration handling so ACR values reach the auth request, then verify that the configured values are included in the resulting request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100