Skip to content

Extract Gitlab::JwtBase

Pedro Pombeiro (OOO from July 16th till Aug 7th) requested to merge pedropombeiro/438420/add-support-for-custom-claims into master

What does this MR do and why?

This MR adds extracts a Gitlab::JwtBase class from Gitlab::Ci::Jwt, so that this class can be used outside of CI scenarios. An example is !142054 (merged) (and others related to artifact repository) where we need to pass a wlif claim, and want to avoid using a special-case class such as ::GoogleCloudPlatform::Jwt.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Comparison of token generated with::GoogleCloudPlatform::Jwt.new and Gitlab::Jwt.new:

image

Comparison of token generated with::GoogleCloudPlatform::Jwt.new and Gitlab::Ci::JwtV2.for_build:

image

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

  1. On the Rails console, test generating and decoding a JWT token with just aud claim:

    puts `jwt decode "#{Gitlab::Ci::JwtV2.for_build(Ci::Build.last, additional_claims: { aud: "https://auth.gcp.gitlab.com/oidc/gitlab-org")} }"`

  2. Now test generating and decoding a JWT token that in addition has a wlif claim:

    puts `jwt decode "#{Gitlab::Ci::JwtV2.for_build(Ci::Build.last, additional_claims: { aud: "https://auth.gcp.gitlab.com/oidc/gitlab-org", wlif_url: "//iam.googleapis.com/foo")} }"`

Notice that the wlif claim is present in the decoded token.

Edited by Pedro Pombeiro (OOO from July 16th till Aug 7th)

Merge request reports