backend(oidc): Add support for custom CA and skipping TLS verification #2880
+98
−15
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dosubot
bot
added
the
size:L
yolossn
force-pushed
the
support-oidc-custom-certs
branch
from
247dfa7 to
dc9f4e9
Compare
this patch adds support for custom CA and skipping TLS verification for OIDC provider verification. This improves flexibility for users working with self-signed OIDC providers. Signed-off-by: yolossn <[email protected]>
yolossn
force-pushed
the
support-oidc-custom-certs
branch
from
dc9f4e9 to
df018e2
Compare
|
Backend Code coverage changed from 65.0% to 64.4%. Change: -.6% 😞. Coverage report |
|
I’ve added support for both skipping TLS verification ( Although TLS skip verification was introduced in #130, it applies to all clusters, not just in-cluster. This update ensures that TLS settings are applied specifically for in-cluster OIDC configuration. https://github.com/headlamp-k8s/headlamp/blob/main/backend/cmd/headlamp.go#L520-L530 @illume, should we deprecate the existing |
We definitely need to keep it for backwards compatibility. |
illume
requested changes
Feb 11, 2025
| } | ||
| // check if the file is a valid PEM file | ||
| caCertPool := x509.NewCertPool() | ||
| if !caCertPool.AppendCertsFromPEM(caFile) { |
There was a problem hiding this comment.
Can you please rename the caFile to caFileContents? Currently it shares the same convention as the config.OidcCAFile... which lead me to believe from just reading this part that it was a filename.
It might also be worth renaming config.OidcCAFile to config.OidcCAFilePath to be more explicit.
| IdpIssuerURL string | ||
| Scopes []string | ||
| SkipTLSVerify bool | ||
| CACert string |
There was a problem hiding this comment.
Can you please document this field?
|
|
||
| if oidcAuthConfig.SkipTLSVerify { | ||
| tr := &http.Transport{ | ||
| TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec |
There was a problem hiding this comment.
Please leave a justification in a comment for why gosec was disabled here?
|
|
||
| secureTLSClient := &http.Client{ | ||
| Transport: &http.Transport{ | ||
| TLSClientConfig: &tls.Config{RootCAs: caCertPool}, //nolint:gosec |
There was a problem hiding this comment.
Please leave a justification in a comment for why gosec was disabled here?
| os.Exit(1) | ||
| } | ||
|
|
||
| headlampConfig.oidcCACert = string(caFile) |
| @@ -243,11 +245,25 @@ func (c *Context) OidcConfig() (*OidcConfig, error) { | |||
| return nil, errors.New("authProvider is nil") | |||
| } | |||
|
|
|||
| var caCert string | |||
|
|
|||
| caFilePath, ok := c.AuthInfo.AuthProvider.Config["idp-certificate-authority"] | |||
There was a problem hiding this comment.
Can you please explain what this is in a comment?
|
|
||
| caFilePath, ok := c.AuthInfo.AuthProvider.Config["idp-certificate-authority"] | ||
| if ok { | ||
| caFile, err := os.ReadFile(caFilePath) |
There was a problem hiding this comment.
I wonder where caFilePath comes from and if the path needs to be validated?
illume
added
enhancement
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
this patch adds support for custom CA and skipping TLS verification for OIDC provider verification. This improves flexibility for users working with self-signed OIDC providers.