github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2025-09-01 06:57:45 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #3742 from sagikazarmark/fix-aud-claim-list

Browse Source 
Accept list of strings in audience claim in token auth
This commit is contained in:
Milos Gajdos
2023-04-26 18:39:26 +01:00
committed by GitHub
parent 2fb8dbdeca d6ea77ae65
commit 29b5e79f82
6 changed files with 162 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
registry/auth/token/token.go
View File

@@ -42,13 +42,13 @@ type ResourceActions struct {
// ClaimSet describes the main section of a JSON Web Token.
type ClaimSet struct {
// Public claims
Issuer string `json:"iss"`
Subject string `json:"sub"`
Audience string `json:"aud"`
Expiration int64 `json:"exp"`
NotBefore int64 `json:"nbf"`
IssuedAt int64 `json:"iat"`
JWTID string `json:"jti"`
Issuer string `json:"iss"`
Subject string `json:"sub"`
Audience AudienceList `json:"aud"`
Expiration int64 `json:"exp"`
NotBefore int64 `json:"nbf"`
IssuedAt int64 `json:"iat"`
JWTID string `json:"jti"`
// Private claims
Access []*ResourceActions `json:"access"`
@@ -143,8 +143,8 @@ func (t *Token) Verify(verifyOpts VerifyOptions) error {
}
// Verify that the Audience claim is allowed.
if !contains(verifyOpts.AcceptedAudiences, t.Claims.Audience) {
log.Infof("token intended for another audience: %q", t.Claims.Audience)
if !containsAny(verifyOpts.AcceptedAudiences, t.Claims.Audience) {
log.Infof("token intended for another audience: %v", t.Claims.Audience)
return ErrInvalidToken
}