eliott/ocis
1
0
Fork 0
mirror of https://github.com/owncloud/ocis synced 2026-04-26 01:35:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

oidc: Remove "aud" claim validation of logout tokens (#6156)

Browse Source 
The "aud" claim of the logout token is supposed to contain the client-id
of the client for which the token was issued. Our current implementation of
validating that claim is somewhat broken. We only allow to configure a single
value for the allowed client id. But we have different client-ids
accessing oCIS.

This completely removes the current validation of the `aud` claim until
we come up with a working solution. As we currently require a session id
to be present in the logout token the risk not validating the `aud`
claim is pretty low.

Related: #6149
This commit is contained in:
Ralf Haferkamp
2023-04-27 10:34:09 +02:00
committed by GitHub
parent 8d06b293b4
commit b7990875c1
6 changed files with 2 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
services/proxy/pkg/config/defaults/defaultconfig.go
View File

@@ -53,7 +53,6 @@ func DefaultConfig() *config.Config {
RefreshTimeout: 10, // seconds
RefreshUnknownKID: true,
},
ClientID: "web",
},
PolicySelector: nil,
RoleAssignment: config.RoleAssignment{