Merge pull request #128 from greenbone/AT-1102-remove-issuer-check-from-keycloak-client-golang

Fix: removed issuer validation

Author: larox11

auth/auth.go

@@ -26,7 +26,6 @@ type KeycloakRealmInfo struct {
 	RealmId               string // RealmId is the realm name that is passed to services via env vars
 	AuthServerInternalUrl string // AuthServerInternalUrl should point to keycloak auth server on internal (not public) network, e.g. http://keycloak:8080/auth; used for contacting keycloak for realm certificate for JWT
 	AuthServerPublicUrl   string // AuthServerPublicUrl should point to keycloak auth server on public (not internal) network, e.g. http://localhost:28080/auth; used to validate issuer field in JWT
-	tokenIssuer           string
 }
 
 func (i *KeycloakRealmInfo) validate() error {
@@ -41,7 +40,7 @@ func (i *KeycloakRealmInfo) validate() error {
 		errs = append(errs, fmt.Errorf("couldn't parse auth server internal url: %w", err))
 	}
 
-	authUrl, err := url.ParseRequestURI(i.AuthServerPublicUrl)
+	_, err = url.ParseRequestURI(i.AuthServerPublicUrl)
 	if err != nil {
 		errs = append(errs, fmt.Errorf("couldn't parse auth server public url: %w", err))
 	}
@@ -50,8 +49,6 @@ func (i *KeycloakRealmInfo) validate() error {
 		return fmt.Errorf("\n%w", errors.Join(errs...))
 	}
 
-	i.tokenIssuer = authUrl.JoinPath("/realms/" + i.RealmId).String()
-
 	return nil
 }
 
@@ -154,10 +151,6 @@ func (a *KeycloakAuthorizer) ParseJWT(ctx context.Context, token string) (UserCo
 	}
 	claims := jwtToken.Claims.(*customClaims)
 
-	if claims.RegisteredClaims.Issuer != a.realmInfo.tokenIssuer {
-		return UserContext{}, fmt.Errorf("invalid domain of issuer of token %q", claims.RegisteredClaims.Issuer)
-	}
-
 	if _, _, err := a.client.DecodeAccessToken(ctx, token, a.realmInfo.RealmId); err != nil {
 		return UserContext{}, fmt.Errorf("validation of token failed: %w", err)
 	}

auth/auth_test.go

@@ -86,13 +86,6 @@ func TestParseJWT(t *testing.T) {
 
 	FakeCertResponse(t, authorizer)
 
-	t.Run("No realm info", func(t *testing.T) {
-		userContext, err := authorizer.ParseJWT(context.Background(), noRealmToken)
-
-		assert.ErrorContains(t, err, "invalid domain of issuer")
-		assert.Zero(t, userContext)
-	})
-
 	t.Run("Wrong algorithm", func(t *testing.T) {
 		userContext, err := authorizer.ParseJWT(context.Background(), invalidAlgorithmToken)
 
@@ -125,20 +118,6 @@ func TestParseJWT(t *testing.T) {
 		assert.Zero(t, userContext)
 	})
 
-	t.Run("Invalid issuer", func(t *testing.T) {
-		userContext, err := authorizer.ParseJWT(context.Background(), invalidIssuerToken)
-
-		assert.ErrorContains(t, err, "invalid domain of issuer")
-		assert.Zero(t, userContext)
-	})
-
-	t.Run("Invalid realm", func(t *testing.T) {
-		userContext, err := authorizer.ParseJWT(context.Background(), invalidRealmToken)
-
-		assert.ErrorContains(t, err, "invalid domain of issuer")
-		assert.Zero(t, userContext)
-	})
-
 	t.Run("OK", func(t *testing.T) {
 		userContext, err := authorizer.ParseJWT(context.Background(), validToken)