From ca2c874161e4810bb99f0da50d236cfb1d88caa4 Mon Sep 17 00:00:00 2001 From: Prem Saraswat Date: Thu, 21 Nov 2024 18:41:49 +0530 Subject: [PATCH] authn: grpcutils: Mark ID Tokens optional in cloud mode in gRPC Authenticator (#96824) This patch marks ID tokens as not required when initalising a gRPC Authenticator to be used in `cloud` mode. ID Tokens are still enabled in `cloud` mode, but the `Required` option is set to `false`. This is needed for MT services like Cloud API Server to authenticate against gRPC services like Resource Store with only an Access Token. Signed-off-by: Prem Kumar --- pkg/services/authn/grpcutils/grpc_authenticator.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkg/services/authn/grpcutils/grpc_authenticator.go b/pkg/services/authn/grpcutils/grpc_authenticator.go index bb3256955a1..8b4086f1205 100644 --- a/pkg/services/authn/grpcutils/grpc_authenticator.go +++ b/pkg/services/authn/grpcutils/grpc_authenticator.go @@ -49,14 +49,20 @@ func NewGrpcAuthenticator(cfg *setting.Cfg, tracer tracing.Tracer) (*authnlib.Gr keyRetriever := authnlib.NewKeyRetriever(grpcAuthCfg.KeyRetrieverConfig, authnlib.WithHTTPClientKeyRetrieverOpt(client)) grpcOpts := []authnlib.GrpcAuthenticatorOption{ - authnlib.WithIDTokenAuthOption(true), authnlib.WithKeyRetrieverOption(keyRetriever), authnlib.WithTracerAuthOption(tracer), } - if authCfg.Mode == ModeOnPrem { + switch authCfg.Mode { + case ModeOnPrem: grpcOpts = append(grpcOpts, // Access token are not yet available on-prem authnlib.WithDisableAccessTokenAuthOption(), + authnlib.WithIDTokenAuthOption(true), + ) + case ModeCloud: + grpcOpts = append(grpcOpts, + // ID tokens are enabled but not required in cloud + authnlib.WithIDTokenAuthOption(false), ) }