IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-14 07:04:57 -05:00
Code Issues Packages Projects Releases Wiki Activity

Authn: Share key retriever between id and access token verifiers (#87978)

Browse Source
This commit is contained in:
Karl Persson
2024-05-20 09:13:46 +02:00
committed by GitHub
parent 0a10793840
commit 78d1b2a250
3 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authn/clients/ext_jwt.go
+7 -6
View File
@@ -40,16 +40,17 @@ var (
)
func ProvideExtendedJWT(cfg *setting.Cfg) *ExtendedJWT {
accessTokenVerifier := authlib.NewAccessTokenVerifier(authlib.VerifierConfig{
SigningKeysURL: cfg.ExtJWTAuth.JWKSUrl,
AllowedAudiences: []string{extJWTAccessTokenExpectAudience},
keys := authlib.NewKeyRetriever(authlib.KeyRetrieverConfig{
SigningKeysURL: cfg.ExtJWTAuth.JWKSUrl,
})
accessTokenVerifier := authlib.NewAccessTokenVerifier(authlib.VerifierConfig{
AllowedAudiences: []string{extJWTAccessTokenExpectAudience},
}, keys)
// For ID tokens, we explicitly do not validate audience, hence an empty AllowedAudiences
// Namespace claim will be checked
idTokenVerifier := authlib.NewIDTokenVerifier(authlib.VerifierConfig{
SigningKeysURL: cfg.ExtJWTAuth.JWKSUrl,
})
idTokenVerifier := authlib.NewIDTokenVerifier(authlib.VerifierConfig{}, keys)
return &ExtendedJWT{
cfg: cfg,