<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.gmail-m6173218706944072955xmsonormal, li.gmail-m6173218706944072955xmsonormal, div.gmail-m6173218706944072955xmsonormal
{mso-style-name:gmail-m_6173218706944072955x_msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Thanks Mark. I’ve looked at their Go source code and the checks look OK. Will see. One downside of this approach is that most toolkits, libraries, etc for OAuth2/OIDC retrieve from the Identity Server and inject the access token when calling
any protected client APIs, not the id token. Nothing major, just maybe annoying in some cases.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I will take a look at the proxy. Good stuff. We are not running our K8s with MitreID yet, just exploring. Few little annoying issues using OIDC with K8s, e.g. Dashboard, as you found out. Not sure if SAML or LDAP would be better.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Luiz<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black"><mark@praseodym.net> on behalf of Mark Janssen <callisto@praseodym.net><br>
<b>Date: </b>Monday, February 26, 2018 at 2:15 PM<br>
<b>To: </b>"mitreid-connect@mit.edu" <mitreid-connect@mit.edu><br>
<b>Cc: </b>Luiz Omori <luiz.omori@duke.edu>, Felipe Polo-Wood <felipe.polowood@duke.edu><br>
<b>Subject: </b>Re: [mitreid-connect] Kubernetes Authorization with MitreID OIDC Server<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">The ID token is a signed JWT, so it should be fine as long as Kubernetes checks whether the token is signed correctly and with an expected algorithm (e.g.
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__auth0.com_blog_critical-2Dvulnerabilities-2Din-2Djson-2Dweb-2Dtoken-2Dlibraries_&d=DwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=s_DjMoDvgNBeLry96J335ybbKcLj_6nXAOWrYJO4Mic&s=UPdhgqL3zAOejgMrQ_AQBYQdwxEOxZK8OZyQ2yqfiTk&e=">
it does not accept the "none" algorithm</a>).<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">We're also running Kubernetes with a MitreID OIDC server and it works great. Since v1.3.2 it's easier to
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_WISVCH_connect_blob_5fa64e4bd634bdf4622a32db6d7131c8430150a7_wisvch-2Dconnect-2Doverlay_src_main_java_ch_wisv_connect_overlay_services_CHOIDCTokenService.java&d=DwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=s_DjMoDvgNBeLry96J335ybbKcLj_6nXAOWrYJO4Mic&s=p3CyV2qGaM6aS6Go0s0xKoMxuASbXRjfI72rP8Rtq2g&e=">
add an ID token group claim</a> that can be used for Kubernetes RBAC. We're using
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_WISVCH_oidc-2Dproxy&d=DwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=s_DjMoDvgNBeLry96J335ybbKcLj_6nXAOWrYJO4Mic&s=0gdcV8hkAyR0B66djpFXoW3VJmbsUXnBGHkFObzveD4&e=">
a fork</a> of <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_gambol99_keycloak-2Dproxy&d=DwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=s_DjMoDvgNBeLry96J335ybbKcLj_6nXAOWrYJO4Mic&s=pe8uxEeNS4vZko1XKKeB3RFrWlXBeQt0O27W4J7HXcY&e=">
keycloak-proxy</a> in front of the Kubernetes Dashboard so that users are able to access it without a kubectl proxy. For users that need/want kubectl, we have
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_WISVCH_oidc-2Dkubeconfig&d=DwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=s_DjMoDvgNBeLry96J335ybbKcLj_6nXAOWrYJO4Mic&s=eRaekuIE4Zj2MYSFbNeSeFoKc6kmpjWW40dkM7_EQ3U&e=">
a tiny webapp that can generate kubectl config files</a> including an OIDC refresh token.<o:p></o:p></p>
</div>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
</div>
<p class="MsoNormal">Mark<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 26 February 2018 at 18:14, Felipe Polo-Wood <<a href="mailto:felipe.polowood@duke.edu" target="_blank">felipe.polowood@duke.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div id="gmail-m_6173218706944072955divtagdefaultwrapper">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:8.0pt;color:black">I am trying to wrap my head around what that means... is it encrypted in any way? Does it transit outside K8s?<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:8.0pt;color:black"><o:p> </o:p></span></p>
<div id="gmail-m_6173218706944072955Signature">
<div id="gmail-m_6173218706944072955divtagdefaultwrapper">
<div name="divtagdefaultwrapper">
<div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Felipe Polo-Wood<br>
Sr. Manager Clinical Applications Technical Services<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Duke Health Technology Solutions<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">3100 Tower Blvd. Office 270<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Durham, NC 27707<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Office:
<a href="tel:+1%20919-668-2268" target="_blank">+1.919.668.2268</a><br>
Mobile: <a href="tel:+1%20919-741-4213" target="_blank">+1.919.741.4213</a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="gmail-m_6173218706944072955divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black">
<a href="mailto:mitreid-connect-bounces@mit.edu" target="_blank">mitreid-connect-bounces@mit.edu</a> <<a href="mailto:mitreid-connect-bounces@mit.edu" target="_blank">mitreid-connect-bounces@mit.edu</a>> on behalf of Luiz Omori <<a href="mailto:luiz.omori@duke.edu" target="_blank">luiz.omori@duke.edu</a>><br>
<b>Sent:</b> Monday, February 26, 2018 11:29:41 AM<br>
<b>To:</b> <a href="mailto:mitreid-connect@mit.edu" target="_blank">mitreid-connect@mit.edu</a><br>
<b>Subject:</b> [mitreid-connect] Kubernetes Authorization with MitreID OIDC Server</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<div>
<div>
<p class="gmail-m6173218706944072955xmsonormal" style="background:white">Yes, it works. See instructions here:
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__kubernetes.io_docs_admin_authentication_-23openid-2Dconnect-2Dtokens&d=DwMGaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=A3Yhle7nZIqZWq2hnFMxKnnaih9e8isMynaYEUQaOec&m=846ABQIAO1ZXrQn4e8wK8AbEOeHQ6rF5OfB1raTTgHw&s=fKQIqQm8cL4BhJX8iGpB5d1UnlpJA0VhILB7dvYnuZk&e=" target="_blank">
https://kubernetes.io/docs/admin/authentication/#openid-connect-tokens</a><o:p></o:p></p>
<p class="gmail-m6173218706944072955xmsonormal" style="background:white"> <o:p></o:p></p>
<p class="gmail-m6173218706944072955xmsonormal" style="background:white">Just one caveat: Kubernetes is using the ID Token as the Bearer. Not sure if I’ve seen any applications doing that before. Is this OK?<o:p></o:p></p>
<p class="gmail-m6173218706944072955xmsonormal" style="background:white"> <o:p></o:p></p>
<p class="gmail-m6173218706944072955xmsonormal" style="background:white">Regards,<o:p></o:p></p>
<p class="gmail-m6173218706944072955xmsonormal" style="background:white">Luiz<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
mitreid-connect mailing list<br>
<a href="mailto:mitreid-connect@mit.edu">mitreid-connect@mit.edu</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.mit.edu_mailman_listinfo_mitreid-2Dconnect&d=DwMFaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=R6m41WT3w_KtulQAsSIxc_C2mwuKoWSycEMpss0QQJA&m=s_DjMoDvgNBeLry96J335ybbKcLj_6nXAOWrYJO4Mic&s=Z0zhYVnOc5yp8SbXtU8Bs3VhWrJYY76v9C-uqLAp-WQ&e=" target="_blank">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>