Add second authenticated jwks uri (kubernetes)

[Christoph-Raab]

I have an authenticated VirtualHost that is protected and can be queried with an bearer token (using AuthType auth-openidc, using libapache2-mod-auth-openidc version 2.4.9.4).

Now this endpoint should be extended to also allow service account tokens from kubernetes as well.

First question: Can multiple OIDCOAuthVerifyJwksUri be configure for the same VirtualHost? Testing this it seams like this in always using the second one I configure:

OIDCOAuthVerifyJwksUri https://example.com/openid/v1/keys
OIDCOAuthVerifyJwksUri https://other.com/openid/v1/keys # <- This is always used

Is there any other way to do this?

Second question: The endpoint for verifying keys in kubernetes is protected for some reason. The service account token can be used for authentication as bearer token, which is located at /var/run/secrets/kubernetes.io/serviceaccount/token. Can I somehow use that token when calling the jwks uri? For example with curl

curl -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes.default/openid/v1/jwks

I see the bearer_token set to null in the debug logs when calling that endpoint, but than again that is probably a generic http call. Can I set the access_token from the service account token somehow?

oidc_util_http_call: url=https://kubernetes.default/openid/v1/jwks, data=(null), content_type=(null), basic_auth=null, bearer_token=(null), ssl_validate_server=1, timeout=60, outgoing_proxy=(null), pass_cookies=0, ssl_cert=(null), ssl_key=(null), ssl_key_pwd=(null)

Thank you in advance.

[zandbelt]

mod_oauth2 can be configured with multiple jwks_uri's and seems a better fit for your use case

[zandbelt]

mod_oauth2 was designed to work alongside of mod_auth_openidc: it will also trigger on AuthType auth-openidc and will do so before mod_auth_openidc; the claims will be prefixed differently (by default, on purpose)

[Christoph-Raab]

Thanks, that's not what I meant, sorry. Problem is that the kubernetes jwks uri uses a private CA and is authenticated. Need to figure out if I can define a custom ca.crt and pass a jwt token when calling the endpoint.

oauth2_http_call: curl_easy_perform() failed on: https://kubernetes.default/openid/v1/jwks (SSL peer certificate or SSH remote key was not OK: SSL certificate problem: unable to get local issuer certificate)

with jwks_uri.ssl_verify=false

oauth2_jose_resolve_from_uri: leave: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}

I need to somehow read the token from a file an pass it. But as I'm reading docs, I don't think that's possible.

[zandbelt]

you should be able to turn off SSL validation (if that works for you...) or add the ca.crt to the system ca-cert bundle that libcurl uses, I don't think there's any option to add parmeters to the call to the jwks_uri, certainly not dynamic ones

[Christoph-Raab]

It's not a parameter, I'd need to add the Authorization: Bearer <token> header with a token that is stored in the file at /var/run/secrets/kubernetes.io/serviceaccount/token.

Is it worth opening a feature request in https://github.com/OpenIDC/mod_oauth2 or https://github.com/OpenIDC/liboauth2? The use case shouldn't be that uncommon: Protect an application with a kubernetes service account token.

Something like that would work:

OAuth2TokenVerify jwks_uri https://kubernetes.default/openid/v1/jwks jwks_uri.ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt&jwks_uri.auth=/var/run/secrets/kubernetes.io/serviceaccount/token

[Christoph-Raab]

Workaround see answer below

[Christoph-Raab]

I was able to work around the issues, by writing the key to a file in the required format for the jwk option from an init container

$ cat /etc/apache2/kubernetes-jwk
OAuth2TokenVerify jwk {"use":"sig","kty":"RSA",...}

and including that in my config, using the mod_oauth2:

OAuth2TokenVerify jwks_uri https://example.com/keys
Include /etc/apache2/jwks

[zandbelt]

thanks for sharing!