google-nomulus/release
Lai Jiang 1465410f0e Refactor OIDC-based auth mechanism (#2049)
This PR changes the two flavors of OIDC authentication mechanisms to
verify the same audience. This allows the same token to pass both
mechanisms. Previously the regular OIDC flavor uses the project id as
its required audience, which does not work for local user credentials
(such as ones used by the nomulus tool), which requires a valid OAuth
client ID as audience when minting the token (project id is NOT a valid
OAuth client ID).

I considered allowing multiple audiences, but the result is not as clean
as just using the same everywhere, because the fall-through logic would
have generated a lot of noises for failed attempts.

This PR also changes the client side to solely use OIDC token whenever
possible, including the proxy, cloud scheduler and cloud tasks. The nomulus
tool still uses OAuth access token by default because it requires USER level
authentication, which in turn requires us to fill the User table with objects
corresponding to the email address of everyone needing access to the tool.

TESTED=verified each client is able to make authenticated calls on QA with or
without IAP.
2023-06-27 13:10:31 -04:00
..
builder Refactor OIDC-based auth mechanism (#2049) 2023-06-27 13:10:31 -04:00
prober-cert-updater Prober ssl cert update automation (#2019) 2023-05-03 15:57:50 -04:00
rollback Remove AppEngineServiceUtils (#2003) 2023-04-21 10:11:12 -04:00
schema-deployer Use builder image as a base for schema-deployer and schema-verifier (#1955) 2023-03-13 15:37:02 -04:00
schema-verifier Use builder image as a base for schema-deployer and schema-verifier (#1955) 2023-03-13 15:37:02 -04:00
build_nomulus_for_env.sh Do not delete build cache when building release candidates (#1619) 2022-05-04 12:08:10 -04:00
cloudbuild-delete.yaml Correctly delete all stopped versions except for the most recent 3 (#1511) 2022-02-03 16:04:58 -05:00
cloudbuild-deploy.yaml Refactor OIDC-based auth mechanism (#2049) 2023-06-27 13:10:31 -04:00
cloudbuild-dev-resource.yaml Re-enable tests in RC build (#1130) 2021-05-05 13:53:21 -04:00
cloudbuild-kythe.yaml Make Kythe run work with Gradle 7 (#1727) 2022-08-02 13:19:47 -04:00
cloudbuild-nomulus.yaml Prober ssl cert update automation (#2019) 2023-05-03 15:57:50 -04:00
cloudbuild-proxy.yaml Re-enable tests in RC build (#1130) 2021-05-05 13:53:21 -04:00
cloudbuild-release.yaml Prober ssl cert update automation (#2019) 2023-05-03 15:57:50 -04:00
cloudbuild-renew-prober-certs.yaml Prober ssl cert update automation (#2019) 2023-05-03 15:57:50 -04:00
cloudbuild-schema-deploy.yaml Use SecretManager for nomulus-tool-cloudbuild cred (#1188) 2021-06-02 09:32:57 -04:00
cloudbuild-schema-verify.yaml Remove bracket in Cloud Build script (#1658) 2022-06-08 13:58:56 -04:00
cloudbuild-sync.yaml Re-enable tests in RC build (#1130) 2021-05-05 13:53:21 -04:00
cloudbuild-tag.yaml Re-enable tests in RC build (#1130) 2021-05-05 13:53:21 -04:00
stage_beam_pipeline.sh Add disable_runner_v2 to pipeline options (#1976) 2023-03-30 17:10:37 -04:00