Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

improve error reporting from gcp identity provider #2224

Merged
merged 1 commit into from
Jul 5, 2023
Merged

improve error reporting from gcp identity provider #2224

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ...ance_provider/src/main/java/com/yahoo/athenz/instance/provider/impl/InstanceGCPUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ public InstanceGCPUtils(HttpTransport httpTransport, JsonFactory jsonFactory) {
.setAudience(List.of(expectedAudience))
.build();
}

public GoogleIdToken.Payload validateGCPIdentityToken(final String token, StringBuilder errMsg) {

try {
Expand All @@ -85,6 +86,8 @@ public GoogleIdToken.Payload validateGCPIdentityToken(final String token, String
"email_verified":true,"exp":1678259131,"iat":1678255531,"iss":"https://accounts.google.com","sub":"102023896904281105569"}
*/
return validatedToken.getPayload();
} else {
errMsg.append("ID token was not verified by GCP. Possible reasons: expired token/invalid issuer or audience/invalid signature");
}
} catch (IllegalArgumentException | GeneralSecurityException | IOException e) {
LOGGER.error("unable to validate GCP instance identity token error={} type={}", e.getMessage(), e.getClass());
Expand Down
2 changes: 1 addition & 1 deletion ...nstance_provider/src/main/java/com/yahoo/athenz/instance/provider/impl/InstanceUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ static List<String> processK8SDnsSuffixList(final String propertyName) {
List<String> k8sDnsSuffixes = new ArrayList<>();
final String k8sDnsSuffix = System.getProperty(propertyName);
if (StringUtil.isEmpty(k8sDnsSuffix)) {
LOGGER.error("K8S DNS Suffix not specified - all requests must satisfy standard dns suffix checks");
LOGGER.info("K8S DNS Suffix not specified - all requests must satisfy standard dns suffix checks");
} else {
// in our checks we're going to match against the given suffix so
// when generating the list we'll verify if the suffix starts with
Expand Down