inkandswitch / inkandswitch/backstitch-sync-server
Implement correct OIDC authorization
- Dominant language
- Rust
- Stars
- 16
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Backstitch should not be using the OIDC access token for identity validation, since it may be an opaque string (and, in the case of Endless, is).
Instead, we should be validating identity using the ID token only once. Then, we should be exchanging it for a Backstitch-specific JWT that we manufacture and store.
Additionally, we should allow other services (like containers) to provide authorization to reject/deny connections ad-hoc. For example, querying an arbitrary API to see if a user is allowed to use Backstitch.
Related, we should address this at the same time: https://github.com/inkandswitch/backstitch/issues/315
Contributor guide
Research direction
No files or tests are named. Start by locating the OIDC token validation and connection-authorization entry points in the Rust sync server, then read related issue 315. Done means identity is validated once from the ID token, a stored Backstitch-specific JWT is used afterward, and an external service can deny connections ad hoc.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authentication, authorization, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100