Validate ID Token when OIDC is set

[arkodg]

Description:

Describe the desired behavior, what scenario it enables and how it
would be used.

The OIDC spec calls out verifying the ID Token https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation

This be be enabled by default or opt in

[optional Relevant Links:]

Any extra documentation required to understand the issue.

[arkodg]

cc @denniskniep @zhaohuabing

[markwinter]

Hey, I'm looking to start working on Envoy Gateway and wouldn't mind picking this one up

[markwinter]

/assign @markwinter

[arkodg]

thanks for picking this one up @markwinter, recommend starting off with an API PR

[zhaohuabing]

@arkodg @markwinter I believe this needs to be supported by the Envoy OAuth2 filter first, then we can enable validation in EG.

[arkodg]

@zhaohuabing can't we add jwt authn if this field is set ?

[markwinter]

I found related discussions here
#2425 (comment)
envoyproxy/envoy#32805

I checked that the forward_bearer_token in the oauth2 filter will set the access token in the Authorization header
https://github.com/envoyproxy/envoy/blob/22a07c31780d8b3b95460c0cc7333ab5e14b89ab/source/extensions/filters/http/oauth2/filter.cc#L882-L884

Perhaps this can be implemented by combining oauth2 filter and jwt filter as you mentioned @arkodg , and using jwtExtrator/from_cookies to get the id token from the cookie set by oauth2 filter.

I think I know the path forward here so will start on the API PR

[markwinter]

@arkodg Opened the API PR here if you could have a look please and see if aligns with what you were thinking #5443

[zhaohuabing]

@zhaohuabing can't we add jwt authn if this field is set ?

@arkodg @markwinter I think JWT authentication is used for general-purpose authentication with JWT tokens. However, ID Token Validation requires additional checks specific to OIDC ID tokens. Some general checks, such as iss and claim validation, can be done with the JWT filter, but others—such as alg, nonce, and acr—require validation rules that are unique to OIDC and can't be achieved with the JWT filter.

If our immediate goal is to validate only the iss and claims, this can be handled within the JWT section of a SecurityPolicy. Introducing partial validation within the OIDC API does not provide significant value, as it would duplicate existing functionality of the JWT authn.

[markwinter]

@zhaohuabing

Verifying the alg is part of JWT signed token verification, that's why JWKS can be supplied in the JWT Authentication filter.

https://github.com/envoyproxy/envoy/blob/eb398e9e4e0e33c8d68d5b9f86db88f236fd57c4/source/extensions/filters/http/jwt_authn/authenticator.cc#L324

https://github.com/google/jwt_verify_lib/blob/master/src/verify.cc#L210

The nonce and acr are oidc specific though and are dependent on whether they were requested in the initial authentication request

[zhaohuabing]

@zhaohuabing

Verifying the alg is part of JWT signed token verification, that's why JWKS can be supplied in the JWT Authentication filter.

I mean this alg validation:

The alg value SHOULD be the default of RS256 or the algorithm sent by the Client in the id_token_signed_response_alg parameter during Registration