fix: openid foward original id token #12439
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cgmEdi
changed the title
dosubot
bot
added
size:L
|
I need to check the original issue before reviewing this PR. |
There was a problem hiding this comment.
Pull Request Overview
This PR adds a new configuration option set_id_token_original_header to the OpenID Connect plugin that allows forwarding the original ID token (with JWS signature and headers) in a new X-ID-Token-Original header. This addresses downstream use cases requiring the original token for operations like token exchange.
- Adds
set_id_token_original_headerboolean configuration option (defaults to true) - Implements logic to set
X-ID-Token-Originalheader with the encrypted ID token from session data - Updates documentation and tests to reflect the new functionality
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| apisix/plugins/openid-connect.lua | Adds schema definition and header-setting logic for the new set_id_token_original_header option |
| docs/en/latest/plugins/openid-connect.md | Documents the new configuration parameter in the plugin attributes table |
| t/plugin/openid-connect.t | Adds test coverage for the new header functionality and updates expected responses |
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
Hi @cgmEdi, there is a conflicting file that needs to be resolved. |
dosubot
bot
added
size:S
Hi @Baoyuantop, the conflict is resolved now :). |
|
Hi @cgmEdi, please fix failed ci. |
|
Hi @cgmEdi, any updates? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Issue: #10275 #12438
Summary: add a config option "set original id token header" so that the original id_token that was stored in the sesssion (enc_id_token) gets fowarded as the new header "X-Id-Token-Original".
In my company, we have a use case, where the donwstream needs the original id_token so that it can perform a token exchange.
Which issue(s) this PR fixes:
Fixes #10275 #12438
Checklist