Conversation
…er grants Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add YAML-configurable trusted keys for federated JWT-bearer grants
auth.m2m: YAML-configurable trusted keys for federated JWT-bearer grants
Mar 11, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a YAML-configurable path for registering trusted external JWT issuers for the auth.m2m JWT-bearer grant, including optional audience validation and claim remapping, so consumers don’t need Go-side boilerplate to call AddTrustedKey manually.
Changes:
- Extend
auth.m2mto store per-trusted-issuer metadata (audiences + claim mapping) and addAddTrustedKeyFromPEMfor PEM-based registration (with\nnormalization). - Enforce audience checks and apply claim mapping during JWT-bearer assertion validation.
- Update the auth plugin factory + schema and add tests covering trusted-keys configuration and the new behaviors.
Reviewed changes
Copilot reviewed 4 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
module/auth_m2m.go |
Adds trusted-key config/types, PEM registration helper, and audience + claim-mapping handling in JWT assertion validation. |
plugins/auth/plugin.go |
Parses trustedKeys from module config and registers them; updates schema description to document the new config. |
plugins/auth/plugin_test.go |
Adds a factory-level integration test ensuring YAML-configured trusted keys allow JWT-bearer grants. |
module/auth_m2m_test.go |
Adds unit/integration tests for PEM parsing, newline normalization, audience enforcement, and claim mapping. |
module/scan_provider_test.go |
Formatting-only adjustments. |
module/platform_do_database.go |
Comment formatting-only adjustments. |
module/platform_do_database_test.go |
Formatting-only adjustments. |
| ecKey, ok := pubAny.(*ecdsa.PublicKey) | ||
| if !ok { | ||
| return fmt.Errorf("auth.m2m: public key for issuer %q is not an ECDSA key", issuer) | ||
| } |
There was a problem hiding this comment.
AddTrustedKeyFromPEM accepts any ECDSA public key returned by x509.ParsePKIXPublicKey, but the module docs/config state only ES256 (P-256) is supported. As written, a P-384/P-521 key could be registered and later validateJWTAssertion would accept assertions signed with ES384/ES512 (since it only checks SigningMethodECDSA), which expands the accepted algorithm set unexpectedly. Consider enforcing ecKey.Curve == elliptic.P256() here (and/or checking token.Header["alg"] == "ES256" in validateJWTAssertion) and returning an error otherwise.
Suggested change
| } | |
| } | |
| if ecKey.Curve != elliptic.P256() { | |
| return fmt.Errorf("auth.m2m: public key for issuer %q must use P-256 (ES256) curve", issuer) | |
| } |
Comment on lines
+218
to
+229
| // Register YAML-configured trusted keys for JWT-bearer grants. | ||
| if trustedKeys, ok := cfg["trustedKeys"].([]any); ok { | ||
| for _, tk := range trustedKeys { | ||
| tkMap, ok := tk.(map[string]any) | ||
| if !ok { | ||
| continue | ||
| } | ||
| issuer := stringFromMap(tkMap, "issuer") | ||
| publicKeyPEM := stringFromMap(tkMap, "publicKeyPEM") | ||
| if issuer == "" || publicKeyPEM == "" { | ||
| continue | ||
| } |
There was a problem hiding this comment.
The auth.m2m factory silently ignores malformed trustedKeys entries (non-map items, missing issuer/publicKeyPEM). For security-sensitive configuration this can lead to surprising runtime auth failures with no clear startup error. Consider failing module init (SetInitErr) with a descriptive error when an entry is invalid, rather than continuing silently.
Contributor
|
@copilot apply changes based on the comments in this thread Build, tests, lint, config validation failing |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
…dling, test fixes, example go.mod Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Contributor
Author
Applied all review changes in 1cfb1c7:
Also added |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Trusted external JWT issuers for the
auth.m2mJWT-bearer grant could only be registered via Go code (AddTrustedKey), forcing consumers to write boilerplate that type-asserts into the service registry. This adds atrustedKeysYAML config path with audience validation and claim remapping.Changes
module/auth_m2m.goTrustedKeyConfig— exported struct for YAML/JSON config (issuer,publicKeyPEM,audiences,claimMapping)trustedKeyEntry— internal struct replacing*ecdsa.PublicKeyin thetrustedKeysmap; carries audiences + claim mapping alongside the keyAddTrustedKeyFromPEM(issuer, pem, audiences, claimMapping)— parses PKIX PEM public keys; normalises literal\nsequences for Docker/Kubernetes env var compatibilityAddTrustedKey()— backward-compatible; wraps key intrustedKeyEntryvalidateJWTAssertion()— now enforces audience constraint and applies claim mapping from the matched entryvalidateAssertionAudience()/applyAssertionClaimMapping()— extracted helpersplugins/auth/plugin.goauth.m2mfactory parses thetrustedKeyslist and callsAddTrustedKeyFromPEMfor each entrytrustedKeysExample
Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.