Teach the authentication artifact an OIDC policy type#1122
Conversation
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
🤖 Augment PR SummarySummary: Adds first-class support for an interactive OIDC authentication policy type in the enterprise authentication artifact. Changes:
Technical Notes: Reference-scope identity for OIDC is derived from issuer + client identifier (independent of which env var holds the client secret). 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| } | ||
|
|
||
| keys.emplace(issuer); | ||
| keys.emplace(client_id); |
There was a problem hiding this comment.
enterprise/authentication/authentication.cc:376-377 collect_oidc_identifiers stores issuer and client_id as separate keys; since audience() unions keys across all governing policies and reference_permitted() uses a subset check, a referent covered by multiple OIDC policies could accidentally satisfy the subset even if no single OIDC policy matches both values. Consider making the OIDC scope identifier atomic (issuer+client_id as one identifier) so mixed-policy combinations can’t pass the check.
Severity: high
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
|
||
| constexpr std::uint32_t AUTHENTICATION_MAGIC{0x48545541}; | ||
| constexpr std::uint32_t AUTHENTICATION_VERSION{5}; | ||
| constexpr std::uint32_t AUTHENTICATION_VERSION{6}; |
There was a problem hiding this comment.
enterprise/authentication/authentication_format.h:11 Bumping AUTHENTICATION_VERSION will make the runtime treat any existing v5 artifact as invalid and fail-closed (deny admissions and reject cross-policy references during indexing). Can you confirm the artifact is always regenerated as part of the normal upgrade/build path so deployments don’t break when upgrading binaries?
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Benchmark Index (community)
Details
| Benchmark suite | Current: 0289aa0 | Previous: d9c0b65 | Ratio |
|---|---|---|---|
Add one schema (0 existing) |
320 ms |
321 ms |
1.00 |
Add one schema (100 existing) |
29 ms |
29 ms |
1 |
Add one schema (1000 existing) |
86 ms |
84 ms |
1.02 |
Add one schema (10000 existing) |
720 ms |
710 ms |
1.01 |
Update one schema (1 existing) |
21 ms |
21 ms |
1 |
Update one schema (101 existing) |
30 ms |
28 ms |
1.07 |
Update one schema (1001 existing) |
87 ms |
85 ms |
1.02 |
Update one schema (10001 existing) |
738 ms |
730 ms |
1.01 |
Cached rebuild (1 existing) |
7 ms |
7 ms |
1 |
Cached rebuild (101 existing) |
9 ms |
9 ms |
1 |
Cached rebuild (1001 existing) |
29 ms |
29 ms |
1 |
Cached rebuild (10001 existing) |
253 ms |
252 ms |
1.00 |
Index 100 schemas |
485 ms |
550 ms |
0.88 |
Index 1000 schemas |
1515 ms |
1490 ms |
1.02 |
Index 10000 schemas |
13764 ms |
13801 ms |
1.00 |
Index 10000 schemas (custom meta-schema) |
16574 ms |
16775 ms |
0.99 |
Index 10000 schemas ($ref fan-out) |
16769 ms |
16575 ms |
1.01 |
This comment was automatically generated by workflow using github-action-benchmark.
There was a problem hiding this comment.
Benchmark Index (enterprise)
Details
| Benchmark suite | Current: 0289aa0 | Previous: d9c0b65 | Ratio |
|---|---|---|---|
Add one schema (0 existing) |
372 ms |
385 ms |
0.97 |
Add one schema (100 existing) |
108 ms |
114 ms |
0.95 |
Add one schema (1000 existing) |
145 ms |
170 ms |
0.85 |
Add one schema (10000 existing) |
789 ms |
808 ms |
0.98 |
Update one schema (1 existing) |
93 ms |
104 ms |
0.89 |
Update one schema (101 existing) |
99 ms |
111 ms |
0.89 |
Update one schema (1001 existing) |
161 ms |
170 ms |
0.95 |
Update one schema (10001 existing) |
826 ms |
811 ms |
1.02 |
Cached rebuild (1 existing) |
6 ms |
9 ms |
0.67 |
Cached rebuild (101 existing) |
7 ms |
11 ms |
0.64 |
Cached rebuild (1001 existing) |
20 ms |
34 ms |
0.59 |
Cached rebuild (10001 existing) |
171 ms |
282 ms |
0.61 |
Index 100 schemas |
698 ms |
667 ms |
1.05 |
Index 1000 schemas |
1496 ms |
1355 ms |
1.10 |
Index 10000 schemas |
13089 ms |
13582 ms |
0.96 |
Index 10000 schemas (custom meta-schema) |
16769 ms |
16154 ms |
1.04 |
Index 10000 schemas ($ref fan-out) |
14677 ms |
16396 ms |
0.90 |
This comment was automatically generated by workflow using github-action-benchmark.
1 participant
Signed-off-by: Juan Cruz Viotti jv@jviotti.com