hashicorp / hashicorp/vault-plugin-auth-jwt

Adding support for acr_values configuration of oidc

Open
#275 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
107
Forks
73
Avg merge
13h 49m
Merged PRs (30d)
7

Description

The oidc specification details the use of ACR Values that can optionally be provided for an auth request.
* https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

This is often coupled with specifying critical requirements to the auth process, like the use of MFA.
* https://developer.okta.com/docs/guides/step-up-authentication/main/

There have been periodic questions in the community about the availability of this feature:
* https://discuss.hashicorp.com/t/acr-values-support-with-oidc-provider-configuration/11826/2
* https://discuss.hashicorp.com/t/mfa-with-oidc-auth-configuration-of-authorization-oauth2-acr-values-xxyyzz/21628

After reviewing the code and following up the code-path laid out by eliasp in the second discussion, it is not too complicated to enable the use of the already existing feature within the [hashicorp/cap](https://pkg.go.dev/github.com/hashicorp/cap@v0.4.1/oidc#WithACRValues) package, internally used by this plugin, it only requires handling the more or less trivial configuration field, the heavy lifting is already implemented.

I am opening this issue to propose a PR with the mentioned feature and coordinate any possible feedback / recommendation / modification requirements.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the OIDC authorization-request configuration and the existing hashicorp/cap oidc.WithACRValues entry point referenced in the issue. Add the configuration handling so ACR values reach the auth request, then verify that the configured values are included in the resulting request.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.