Skip to content

Require email_verified to be used when email is set as username via CEL - #123737

Merged
k8s-ci-robot merged 1 commit into
kubernetes:masterfrom
enj:enj/i/cel_email_verified
Mar 8, 2024
Merged

Require email_verified to be used when email is set as username via CEL#123737
k8s-ci-robot merged 1 commit into
kubernetes:masterfrom
enj:enj/i/cel_email_verified

Conversation

@enj

@enj enj commented Mar 5, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

/kind feature
/kind api-change
/assign liggitt aramase
/triage accepted
/milestone v1.30
/sig auth

Fixes #123675

When configuring a JWT authenticator:

If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
username.expression or extra[*].valueExpression or claimValidationRules[*].expression.
An example claim validation rule expression that matches the validation automatically
applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'.

xref: #130875

@k8s-ci-robot k8s-ci-robot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Mar 5, 2024
@k8s-ci-robot k8s-ci-robot added this to the v1.30 milestone Mar 5, 2024
@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API triage/accepted Indicates an issue or PR is ready to be actively worked on. sig/auth Categorizes an issue or PR as relevant to SIG Auth. labels Mar 5, 2024
@k8s-ci-robot
k8s-ci-robot requested review from sttts and yujuhong March 5, 2024 23:31
@k8s-ci-robot k8s-ci-robot added area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Mar 5, 2024
@k8s-triage-robot

k8s-triage-robot commented Mar 6, 2024

Copy link
Copy Markdown

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

liggitt
liggitt reviewed Mar 6, 2024
View reviewed changes
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/validation/validation.go Resolved
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/validation/validation.go Resolved
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/validation/validation.go Resolved
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/validation/validation.go Resolved
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/validation/validation_test.go Resolved
@k8s-ci-robot k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 7, 2024
aramase
aramase reviewed Mar 7, 2024
View reviewed changes
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go Resolved
Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go
// Same as the --oidc-username-claim and --oidc-username-prefix flags.
// If username.expression is set, the expression must produce a string value.
// If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
// username.expression or extra[*].valueExpression or claimValidationRules[*].expression.

@aramase aramase Mar 7, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add integrations tests using claims.email_verified in

  1. username.expression
  2. extra[*].valueExpression
  3. claimValidationRules[*].expression

@enj enj Mar 7, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can though we can only cover the positive cases since the API server won't start on the negative cases.

@liggitt liggitt Mar 8, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't feel strongly about unit or integration tests as long as the unit tests actually exercise the functional evaluator

@enj enj Mar 8, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Opened #123825, will handle this in a follow-up due to limited time left in the release.

liggitt
liggitt reviewed Mar 8, 2024
View reviewed changes

@liggitt liggitt left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one question on nil checks in the visitor, needs the doc update for v1beta1 @aramase noticed, lgtm otherwise

Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/validation/validation.go
return false
}

func usesEmailVerifiedClaim(ast *celgo.Ast) bool {

@liggitt liggitt Mar 8, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll trust the unit tests and @jpbetz's review of the traversal logic / comparison with the CEL visitor for correctness.

My only comment all the way down the chain is that it's not obvious which of the fields can be nil, and where the visitor currently works but would panic if it got an AST that was valid but unexpected.

Two ways to resolve that:

  1. know for sure what can / can't be nil (now or in the future with any possible future AST changes)
  2. check everything that can be nil for nil explicitly

@enj enj Mar 8, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added nil checks for everything.

Comment thread staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1alpha1/types.go
// Same as the --oidc-username-claim and --oidc-username-prefix flags.
// If username.expression is set, the expression must produce a string value.
// If username.expression uses 'claims.email', then 'claims.email_verified' must be used in
// username.expression or extra[*].valueExpression or claimValidationRules[*].expression.

@liggitt liggitt Mar 8, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't feel strongly about unit or integration tests as long as the unit tests actually exercise the functional evaluator

@liggitt liggitt mentioned this pull request Mar 8, 2024
Merged
5 tasks done
@enj enj mentioned this pull request Mar 8, 2024
Open
@enj
enj force-pushed the enj/i/cel_email_verified branch from f6a102f to 121607e Compare March 8, 2024 17:59
aramase
aramase reviewed Mar 8, 2024
View reviewed changes

@aramase aramase left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 8, 2024
@k8s-ci-robot

k8s-ci-robot commented Mar 8, 2024

Copy link
Copy Markdown
Contributor

LGTM label has been added.

DetailsGit tree hash: 5d10fb759700fcf75c98372c30ff0ea165a3c44d

@liggitt

liggitt commented Mar 8, 2024

Copy link
Copy Markdown
Member

/lgtm
/approve

@k8s-ci-robot

k8s-ci-robot commented Mar 8, 2024

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enj, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 8, 2024
@k8s-ci-robot
k8s-ci-robot merged commit 9a160fa into kubernetes:master Mar 8, 2024
@enj enj mentioned this pull request Mar 11, 2024
Closed
63 tasks done
mhan8796 pushed a commit to mhan8796/kubernetes that referenced this pull request Jun 27, 2026
@k8s-ci-robot
Merge pull request kubernetes#123737 from enj/enj/i/cel_email_verified
1840a8c 
Require email_verified to be used when email is set as username via CEL
@coderabbitai coderabbitai Bot mentioned this pull request Jul 1, 2026
Merged
7 of 8 tasks
IvanHunters added a commit to cozystack/website that referenced this pull request Jul 1, 2026
@IvanHunters
docs(kubernetes): note emailVerified prerequisite for System-mode OIDC
5cd4b7e 
When `username.claim` is `email` the tenant kube-apiserver rejects
tokens with `email_verified: false` (kubernetes/kubernetes#123737).
Add a gotcha entry so operators provisioning cozy-realm users through
KeycloakRealmUser or the Keycloak UI set `emailVerified: true` before
granting cluster access, avoiding a silent "oidc: email not verified"
at login.

Signed-off-by: IvanHunters <[email protected]>
myasnikovdaniil pushed a commit to cozystack/website that referenced this pull request Aug 12, 2026
@IvanHunters @myasnikovdaniil
docs(kubernetes): note emailVerified prerequisite for System-mode OIDC
ac93c47 
When `username.claim` is `email` the tenant kube-apiserver rejects
tokens with `email_verified: false` (kubernetes/kubernetes#123737).
Add a gotcha entry so operators provisioning cozy-realm users through
KeycloakRealmUser or the Keycloak UI set `emailVerified: true` before
granting cluster access, avoiding a silent "oidc: email not verified"
at login.

Signed-off-by: IvanHunters <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@liggitt liggitt liggitt left review comments
@sttts sttts Awaiting requested review from sttts
@yujuhong yujuhong Awaiting requested review from yujuhong
+3 more reviewers
@TristonianJones TristonianJones TristonianJones left review comments
@jpbetz jpbetz jpbetz left review comments
@aramase aramase aramase left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@liggitt liggitt

@aramase aramase

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.

Projects

SIG Auth
Archived in project
[sig-release] Bug Triage
Archived in project

Milestone

v1.30

Development

Successfully merging this pull request may close these issues.

Document email_verified check when CEL expression is used in authentication configuration

7 participants

@enj @k8s-triage-robot @k8s-ci-robot @liggitt @TristonianJones @jpbetz @aramase