Bind JWT negative probes to exact claim and cleanup evidence
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
f97f006ede
commit
aef56bcba1
4 changed files with 322 additions and 22 deletions
|
|
@ -21,7 +21,7 @@ import urllib.error
|
|||
import urllib.parse
|
||||
import urllib.request
|
||||
|
||||
SCHEMA = 'keycape.openbao-negative-probe.v1'
|
||||
SCHEMA = 'keycape.openbao-negative-probe.v2'
|
||||
CLAIM_PROBES = [
|
||||
('aud', 'openbao-probe-aud', 'openbao:login'),
|
||||
('sub', 'openbao-probe-sub', 'openbao:login'),
|
||||
|
|
@ -34,6 +34,11 @@ CODING_AGENT = ('coding_agent', 'codex-railiance-platform', 'openbao:login')
|
|||
DEFAULT_LEEWAY = 150 # OpenBao jwt auth expiration_leeway default, seconds
|
||||
|
||||
|
||||
class NoRedirect(urllib.request.HTTPRedirectHandler):
|
||||
def redirect_request(self, req, fp, code, msg, headers, newurl):
|
||||
return None
|
||||
|
||||
|
||||
class Inconclusive(Exception):
|
||||
"""The probe could not tell refusal from failure; never counted as a refusal."""
|
||||
|
||||
|
|
@ -48,7 +53,7 @@ def http_post(url, form=None, body=None, headers=None, timeout=15):
|
|||
headers['Content-Type'] = 'application/json'
|
||||
req = urllib.request.Request(url, data=data, headers=headers, method='POST')
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=timeout) as resp:
|
||||
with urllib.request.build_opener(NoRedirect()).open(req, timeout=timeout) as resp:
|
||||
return resp.status, resp.read()
|
||||
except urllib.error.HTTPError as err:
|
||||
return err.code, err.read()
|
||||
|
|
@ -61,7 +66,7 @@ def classify(errors_text):
|
|||
text = errors_text.lower()
|
||||
if 'principal_type' in text:
|
||||
return 'not_service_principal'
|
||||
if re.search(r'expired|\bexp\b|not valid yet|nbf', text):
|
||||
if re.search(r'expired|\bexp\b', text):
|
||||
return 'expired'
|
||||
if re.search(r'claim|audience|\baud\b|subject|\bsub\b|bound', text):
|
||||
return 'claim_mismatch'
|
||||
|
|
@ -76,11 +81,51 @@ def exchange(post, token_endpoint, client_id, secret, scope):
|
|||
if status != 200:
|
||||
raise Inconclusive('token_exchange_failed')
|
||||
try:
|
||||
return json.loads(raw)['access_token']
|
||||
token = json.loads(raw)['access_token']
|
||||
if not isinstance(token, str) or not token:
|
||||
raise ValueError
|
||||
return token
|
||||
except (ValueError, KeyError, TypeError):
|
||||
raise Inconclusive('token_response_invalid')
|
||||
|
||||
|
||||
REFERENCE = {'aud': 'secrets-engine-openbao', 'sub': 'service:secrets-engine',
|
||||
'tenant': 'tenant:platform', 'roles': ['secrets-engine'],
|
||||
'scope': 'openbao:login', 'principal_type': 'service'}
|
||||
|
||||
|
||||
def check_claims(token, case, now):
|
||||
"""Inspect claim shape for probe isolation, without asserting signature validity."""
|
||||
try:
|
||||
if not isinstance(token, str):
|
||||
raise ValueError
|
||||
payload = token.split('.')[1]
|
||||
claims = json.loads(base64.urlsafe_b64decode(payload + '=' * (-len(payload) % 4)))
|
||||
exp = claims['exp']
|
||||
if not isinstance(exp, int) or isinstance(exp, bool) or exp <= now():
|
||||
raise ValueError
|
||||
if claims.get('iss') != 'https://kc.coulomb.social':
|
||||
raise ValueError
|
||||
if 'nbf' in claims and claims['nbf'] > now():
|
||||
raise ValueError
|
||||
mismatches = {key for key, expected in REFERENCE.items() if claims.get(key) != expected}
|
||||
expected = set() if case == 'expired' else {case}
|
||||
if case == 'principal_type':
|
||||
valid = claims.get('principal_type') == 'human'
|
||||
elif case == 'coding_agent':
|
||||
valid = claims.get('principal_type') == 'service' and 'coding-agent' in claims.get('roles', [])
|
||||
else:
|
||||
valid = mismatches == expected
|
||||
if case == 'expired':
|
||||
issued = claims.get('iat')
|
||||
valid = valid and isinstance(issued, int) and not isinstance(issued, bool) and 0 < exp - issued <= 60
|
||||
if not valid:
|
||||
raise ValueError
|
||||
return exp
|
||||
except (IndexError, ValueError, KeyError, TypeError):
|
||||
raise Inconclusive('probe_claims_invalid')
|
||||
|
||||
|
||||
def jwt_exp(token):
|
||||
try:
|
||||
payload = token.split('.')[1]
|
||||
|
|
@ -95,6 +140,8 @@ def present(post, bao_addr, mount, role, token):
|
|||
if status == 200:
|
||||
try:
|
||||
bao_token = json.loads(raw)['auth']['client_token']
|
||||
if not isinstance(bao_token, str) or not bao_token:
|
||||
raise ValueError
|
||||
except (ValueError, KeyError, TypeError):
|
||||
return False, 'accepted', False
|
||||
rstatus, _ = post(f'{bao_addr}/v1/auth/token/revoke-self', body={},
|
||||
|
|
@ -102,7 +149,10 @@ def present(post, bao_addr, mount, role, token):
|
|||
return False, 'accepted', rstatus == 204
|
||||
if status in (400, 403):
|
||||
try:
|
||||
errors = ' '.join(str(e) for e in json.loads(raw).get('errors', []))
|
||||
items = json.loads(raw).get('errors', [])
|
||||
if not isinstance(items, list) or not all(isinstance(e, str) for e in items):
|
||||
raise ValueError
|
||||
errors = ' '.join(items)
|
||||
except (ValueError, AttributeError):
|
||||
errors = ''
|
||||
if errors:
|
||||
|
|
@ -112,23 +162,35 @@ def present(post, bao_addr, mount, role, token):
|
|||
|
||||
def run(post, secrets, token_endpoint, bao_addr, mount, role, human_token=None,
|
||||
leeway=DEFAULT_LEEWAY, sleep=time.sleep, now=time.time):
|
||||
if isinstance(leeway, bool) or not isinstance(leeway, int) or leeway < 0:
|
||||
raise Inconclusive('leeway_invalid')
|
||||
cases = []
|
||||
halted = False
|
||||
|
||||
def record(case, fn):
|
||||
nonlocal halted
|
||||
try:
|
||||
if halted:
|
||||
raise Inconclusive('session_aborted')
|
||||
refused, cls, revoked = fn()
|
||||
entry = {'case': case, 'refused': refused, 'class': cls}
|
||||
expected = {'expired': {'expired'}, 'principal_type': {'not_service_principal', 'claim_mismatch'},
|
||||
'coding_agent': {'not_service_principal', 'claim_mismatch'}}.get(case, {'claim_mismatch'})
|
||||
semantic = refused and cls in expected
|
||||
entry = {'case': case, 'refused': refused, 'class': cls, 'verified': semantic}
|
||||
if revoked is not None:
|
||||
entry['revoked'] = revoked
|
||||
if revoked is False:
|
||||
halted = True
|
||||
except Inconclusive as err:
|
||||
entry = {'case': case, 'refused': False, 'class': 'inconclusive', 'reason': str(err)}
|
||||
entry = {'case': case, 'refused': False, 'class': 'inconclusive', 'verified': False, 'reason': str(err)}
|
||||
cases.append(entry)
|
||||
|
||||
def via_client(client_id, scope):
|
||||
def via_client(case, client_id, scope):
|
||||
if client_id not in secrets:
|
||||
raise Inconclusive('secret_not_supplied')
|
||||
return present(post, bao_addr, mount, role,
|
||||
exchange(post, token_endpoint, client_id, secrets[client_id], scope))
|
||||
token = exchange(post, token_endpoint, client_id, secrets[client_id], scope)
|
||||
check_claims(token, case, now)
|
||||
return present(post, bao_addr, mount, role, token)
|
||||
|
||||
# Mint the expiry token first so its wait overlaps the other cases.
|
||||
expiry_token, expiry_error = None, None
|
||||
|
|
@ -136,18 +198,25 @@ def run(post, secrets, token_endpoint, bao_addr, mount, role, human_token=None,
|
|||
if EXPIRY_PROBE[1] not in secrets:
|
||||
raise Inconclusive('secret_not_supplied')
|
||||
expiry_token = exchange(post, token_endpoint, EXPIRY_PROBE[1], secrets[EXPIRY_PROBE[1]], EXPIRY_PROBE[2])
|
||||
expires_at = jwt_exp(expiry_token)
|
||||
expires_at = check_claims(expiry_token, 'expired', now)
|
||||
refused, cls, revoked = present(post, bao_addr, mount, role, expiry_token)
|
||||
if refused or cls != 'accepted' or revoked is not True:
|
||||
raise Inconclusive('expiry_positive_control_failed')
|
||||
except Inconclusive as err:
|
||||
expiry_error = err
|
||||
halted = True
|
||||
|
||||
for case, client_id, scope in CLAIM_PROBES:
|
||||
record(case, lambda c=client_id, s=scope: via_client(c, s))
|
||||
record(CODING_AGENT[0], lambda: via_client(CODING_AGENT[1], CODING_AGENT[2]))
|
||||
record(case, lambda c=client_id, s=scope: via_client(case, c, s))
|
||||
record(CODING_AGENT[0], lambda: via_client(CODING_AGENT[0], CODING_AGENT[1], CODING_AGENT[2]))
|
||||
if human_token:
|
||||
record('principal_type', lambda: present(post, bao_addr, mount, role, human_token))
|
||||
def principal():
|
||||
check_claims(human_token, 'principal_type', now)
|
||||
return present(post, bao_addr, mount, role, human_token)
|
||||
record('principal_type', principal)
|
||||
else:
|
||||
cases.append({'case': 'principal_type', 'refused': False, 'class': 'inconclusive',
|
||||
'reason': 'human_token_not_supplied'})
|
||||
'verified': False, 'reason': 'human_token_not_supplied'})
|
||||
|
||||
def expired():
|
||||
if expiry_error:
|
||||
|
|
@ -164,7 +233,9 @@ def run(post, secrets, token_endpoint, bao_addr, mount, role, human_token=None,
|
|||
'mount': mount,
|
||||
'role': role,
|
||||
'cases': cases,
|
||||
'all_refused': all(c['refused'] for c in cases),
|
||||
'all_refused': all(c['verified'] for c in cases),
|
||||
'expiry_positive_control_verified': expiry_error is None,
|
||||
'expiration_leeway_seconds': leeway,
|
||||
'values_retained': False,
|
||||
}
|
||||
|
||||
|
|
@ -179,7 +250,7 @@ def main(argv=None):
|
|||
ap.add_argument('--leeway', type=int, default=DEFAULT_LEEWAY,
|
||||
help='the role mount expiration_leeway in seconds')
|
||||
args = ap.parse_args(argv)
|
||||
if not args.issuer.startswith('https://') or not args.bao_addr.startswith('https://'):
|
||||
if args.issuer.rstrip('/') != 'https://kc.coulomb.social' or not args.bao_addr.startswith('https://') or args.leeway < 0:
|
||||
print(json.dumps({'schema': SCHEMA, 'error': 'https_required'}))
|
||||
return 2
|
||||
try:
|
||||
|
|
@ -198,8 +269,12 @@ def main(argv=None):
|
|||
print(json.dumps({'schema': SCHEMA, 'error': 'human_token_file_invalid'}))
|
||||
return 2
|
||||
try:
|
||||
with urllib.request.urlopen(args.issuer.rstrip('/') + '/.well-known/openid-configuration', timeout=15) as r:
|
||||
with urllib.request.build_opener(NoRedirect()).open(args.issuer.rstrip('/') + '/.well-known/openid-configuration', timeout=15) as r:
|
||||
token_endpoint = json.loads(r.read())['token_endpoint']
|
||||
issuer_url = urllib.parse.urlsplit(args.issuer)
|
||||
endpoint_url = urllib.parse.urlsplit(token_endpoint)
|
||||
if (endpoint_url.scheme, endpoint_url.netloc) != (issuer_url.scheme, issuer_url.netloc) or endpoint_url.username or endpoint_url.password:
|
||||
raise ValueError
|
||||
except (OSError, ValueError, KeyError):
|
||||
print(json.dumps({'schema': SCHEMA, 'error': 'discovery_failed'}))
|
||||
return 2
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue