-
Notifications
You must be signed in to change notification settings - Fork 352
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fallback to env variable for oidc,oauth2 client id and secret #3217
Conversation
Signed-off-by: Carl Zhou <czhou@brex.com>
Possibly closes #1952 |
cc: @szuecs please help review 🙏 |
Signed-off-by: Carl Zhou <czhou@brex.com>
Signed-off-by: Carl Zhou <czhou@brex.com>
filters/auth/oidc.go
Outdated
@@ -242,19 +243,29 @@ func (s *tokenOidcSpec) CreateFilter(args []interface{}) (filters.Filter, error) | |||
validity = defaultCookieValidity | |||
} | |||
|
|||
oidcClientId := sargs[paramClientID] | |||
if oidcClientId == "" { | |||
oidcClientId, _ = os.LookupEnv("OIDC_CLIENT_ID") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should lookup once in skipper.go and pass the result values via OidcOptions
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The existing OidcOptions struct does not have OIDC_Client_ID - should that be added to the field as a struct?
In addition would the arguments parsing in oidc.go have to be updated? https://github.com/zalando/skipper/blob/master/filters/auth/oidc.go#L80
Edit: I have added the two fields as structs and fetch the env variables in skipper.go
To close #1952 we would need to use |
Signed-off-by: Carl Zhou <czhou@brex.com>
Changes look good. Please update the docs for the filters: see docs/reference/filters.md table in https://opensource.zalando.com/skipper/reference/filters/#oauth2 For CLI flags we would override CLI values with the ENV, which should be written in help messages: |
Signed-off-by: Carl Zhou <czhou@brex.com>
Signed-off-by: Carl Zhou <czhou@brex.com>
Docs have been updated. |
👍 |
2 similar comments
👍 |
👍 |
thanks @czhou-brex for your contribution 🙏! |
Signed-off-by: Carl Zhou <czhou@brex.com>
Similar to secureOauthTokenintrospectionAllKV, support falling back to environment varible for client id and secret for oidc and oauth2 filters, when the values passed in are empty strings.
This will allow compatibility with external secret stores.
Testing: