mirror of
https://github.com/google/nomulus.git
synced 2025-07-27 21:16:25 +02:00
fdfbb9572d
This PR changes the two flavors of OIDC authentication mechanisms to verify the same audience. This allows the same token to pass both mechanisms. Previously the regular OIDC flavor uses the project id as its required audience, which does not work for local user credentials (such as ones used by the nomulus tool), which requires a valid OAuth client ID as audience when minting the token (project id is NOT a valid OAuth client ID). I considered allowing multiple audiences, but the result is not as clean as just using the same everywhere, because the fall-through logic would have generated a lot of noises for failed attempts. This PR also changes the client side to solely use OIDC token whenever possible, including the proxy, cloud scheduler and cloud tasks. The nomulus tool still uses OAuth access token by default because it requires USER level authentication, which in turn requires us to fill the User table with objects corresponding to the email address of everyone needing access to the tool. TESTED=verified each client is able to make authenticated calls on QA with or without IAP. |
||
|---|---|---|
| .. | ||
| kubernetes | ||
| src | ||
| terraform | ||
| .gitignore | ||
| build.gradle | ||
| buildscript-gradle.lockfile | ||
| deploy-proxy-for-env.sh | ||
| Dockerfile | ||
| gradle.lockfile | ||