Validate ID Token when OIDC is set

[arkodg]

Description:

Describe the desired behavior, what scenario it enables and how it
would be used.

The OIDC spec calls out verifying the ID Token https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation

This be be enabled by default or opt in

[optional Relevant Links:]

Any extra documentation required to understand the issue.

[arkodg]

cc @denniskniep @zhaohuabing

[markwinter]

Hey, I'm looking to start working on Envoy Gateway and wouldn't mind picking this one up

[markwinter]

/assign @markwinter

[arkodg]

thanks for picking this one up @markwinter, recommend starting off with an API PR

[zhaohuabing]

@arkodg @markwinter I believe this needs to be supported by the Envoy OAuth2 filter first, then we can enable validation in EG.

[arkodg]

@zhaohuabing can't we add jwt authn if this field is set ?

[markwinter]

I found related discussions here
#2425 (comment)
envoyproxy/envoy#32805

I checked that the forward_bearer_token in the oauth2 filter will set the access token in the Authorization header
https://github.com/envoyproxy/envoy/blob/22a07c31780d8b3b95460c0cc7333ab5e14b89ab/source/extensions/filters/http/oauth2/filter.cc#L882-L884

Perhaps this can be implemented by combining oauth2 filter and jwt filter as you mentioned @arkodg , and using jwtExtrator/from_cookies to get the id token from the cookie set by oauth2 filter.

I think I know the path forward here so will start on the API PR

[markwinter]

@arkodg Opened the API PR here if you could have a look please and see if aligns with what you were thinking #5443