diff options
Diffstat (limited to 'src/conf_mode/service_https.py')
| -rwxr-xr-x | src/conf_mode/service_https.py | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py index d10825ab5..10e0afe49 100755 --- a/src/conf_mode/service_https.py +++ b/src/conf_mode/service_https.py @@ -121,6 +121,15 @@ def verify(https): if dict_search('api.rest.authentication.oidc.issuer', https) is None: raise ConfigError('OIDC issuer must be configured when jwks-url is set') + if dict_search('api.rest.authentication.oidc.issuer', https) is not None: + if dict_search('api.rest.authentication.oidc.audience', https) is None: + raise ConfigError( + 'OIDC audience must be configured when issuer is set. ' + 'Without it, any valid token issued by the trusted issuer ' + 'for a different application would be accepted, granting ' + 'full API privileges to an unrelated token holder.' + ) + # Check if server port is already in use by a different application listen_address = ['0.0.0.0'] port = int(https['port']) @@ -160,9 +169,18 @@ def verify(https): # If only key-based methods are enabled, # fail the commit if no valid key configurations are found mtls_auth = dict_search('certificates.verify_client', https) is not None - if (not valid_keys_exist) and (not jwt_auth) and (not mtls_auth): + oidc_auth = ( + dict_search('api.rest.authentication.oidc.issuer', https) is not None + ) + if ( + (not valid_keys_exist) + and (not jwt_auth) + and (not mtls_auth) + and (not oidc_auth) + ): raise ConfigError( - 'At least one HTTPS API key is required unless GraphQL token or mTLS authentication is enabled!' + 'At least one HTTPS API key is required unless GraphQL token, ' + 'mTLS, or OIDC authentication is enabled!' ) if (not valid_keys_exist) and jwt_auth: @@ -171,6 +189,10 @@ def verify(https): Warning( 'API keys are not configured: only mTLS client certificate authentication will be available for the REST API!' ) + if (not valid_keys_exist) and oidc_auth and not jwt_auth and not mtls_auth: + Warning( + 'API keys are not configured: only OIDC authentication will be available for the REST API!' + ) return None |