oidc: Remove "aud" claim validation of logout tokens (#6156)

The "aud" claim of the logout token is supposed to contain the client-id
of the client for which the token was issued. Our current implementation of
validating that claim is somewhat broken. We only allow to configure a single
value for the allowed client id. But we have different client-ids
accessing oCIS.

This completely removes the current validation of the `aud` claim until
we come up with a working solution. As we currently require a session id
to be present in the logout token the risk not validating the `aud`
claim is pretty low.

Related: #6149
This commit is contained in:
Ralf Haferkamp
2023-04-27 10:34:09 +02:00
committed by GitHub
parent 8d06b293b4
commit b7990875c1
6 changed files with 2 additions and 111 deletions

View File

@@ -87,8 +87,6 @@ func Server(cfg *config.Config) *cli.Command {
oidc.WithHTTPClient(oidcHTTPClient),
oidc.WithOidcIssuer(cfg.OIDC.Issuer),
oidc.WithJWKSOptions(cfg.OIDC.JWKS),
oidc.WithClientID(cfg.OIDC.ClientID),
oidc.WithSkipClientIDCheck(cfg.OIDC.SkipClientIDCheck),
)
var (