Always honor OAuth tokens
Regardless of external configuration, OAuth tokens should always
work.
This prevents issues where multiple masters exist but only some will
honor OAuth tokens due to differences in configuration.
Bug
@@ -122,18 +122,10 @@ func newAuthenticator(
// OAuth token
// this looks weird because it no longer belongs here (needs to be a remote token auth backed by osin)
- if oauthConfig != nil || len(authConfig.OAuthMetadataFile) > 0 {
- // if we have no OAuthConfig but have an OAuthMetadataFile, we still need to honor OAuth tokens
- // to keep the checks below simple, we build an empty OAuthConfig
- // since we do not know anything about the remote OAuth server's config,
- // we assume it supports the bootstrap oauth user by setting a non-nil session config
- if oauthConfig == nil {
- oauthConfig = &osinv1.OAuthConfig{
- SessionConfig: &osinv1.SessionConfig{},
- }
- }
-
validators := []oauth.OAuthTokenValidator{oauth.NewExpirationValidator(), oauth.NewUIDValidator()}
+ // if we have an oauth config, try to configure the inactivity timeout
+ // TODO we need to fix config observation / move this to remote token authn so this can be honored in 4.x
+ if oauthConfig != nil {
if inactivityTimeout := oauthConfig.TokenConfig.AccessTokenInactivityTimeoutSeconds; inactivityTimeout != nil {
timeoutValidator := oauth.NewTimeoutValidator(accessTokenGetter, oauthClientLister, *inactivityTimeout, oauthvalidation.MinimumInactivityTimeoutSeconds)
validators = append(validators, timeoutValidator)
@@ -142,17 +134,15 @@ func newAuthenticator(
return nil
}
}
+ }
oauthTokenAuthenticator := oauth.NewTokenAuthenticator(accessTokenGetter, userGetter, groupMapper, validators...)
tokenAuthenticators = append(tokenAuthenticators,
// if you have an OAuth bearer token, you're a human (usually)
group.NewTokenGroupAdder(oauthTokenAuthenticator, []string{bootstrappolicy.AuthenticatedOAuthGroup}))
- if oauthConfig.SessionConfig != nil {
tokenAuthenticators = append(tokenAuthenticators,
// bootstrap oauth user that can do anything, backed by a secret
oauth.NewBootstrapAuthenticator(accessTokenGetter, bootstrapUserDataGetter, validators...))
- }
- }
for _, wta := range authConfig.WebhookTokenAuthenticators {
ttl, err := time.ParseDuration(wta.CacheTTL)
