[stub] Make JWTAuthenticator audience generation simpler
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 739
- Forks
- 85
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 1
Description
Today jwtauthenticators.authentication.concierge.pinniped.dev requires that .spec.audience be non-empty. We could instead allow this field to be left empty and have that mean that the audience for the JWTAuthenticator is the API server generated .metadata.uid.
This would require changes to the server side JWT cache and the get kubeconfig CLI command.
If an old server encounters an empty .spec.audience, it will fail closed and will refuse to honor tokens for that JWTAuthenticator with an oidc: invalid configuration, clientID must be provided or SkipClientIDCheck must be set error.
A kubeconfig generated via an old CLI get kubeconfig command could confuse the login command into not performing the token exchange. This requires further investigation.
cc @mattmoyer
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the server-side JWT cache and the get kubeconfig CLI command, which the issue identifies as needing changes. Investigate empty .spec.audience behavior and compatibility between old and new servers and CLIs; done means the API server UID supplies the audience without breaking token exchange or login.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend, cli
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100