Add support for iss claim in OAuth2 access tokens
Closed, ResolvedPublic
Actions

Description

MediaWiki should be setting an issuer claim on the access token JWT it emits - this is generally useful, conforms the protocol and is generally good. Unfortunately, the oauth2-server library we are using does not support it.

Plan:

Open a proposal upstream to support issuer claim https://github.com/thephpleague/oauth2-server/issues/1137
Implement issuer claim in our fork of the oauth library. https://github.com/wikimedia/oauth2-server/pull/1
Open a PR upstream with the same changes. It seems like the required changes are going to be minimal https://github.com/thephpleague/oauth2-server/pull/1138
Vendor new version of the forked library https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/623430
Use it in OAuth extension to emit issuer claim https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/623434

Details

	Subject	Repo	Branch	Lines +/-
	Emit `iss` claims for oauth2 access token.	mediawiki/extensions/OAuth	master	+60 -12
	Update oauth2-server dependency	mediawiki/vendor	master	+52 -4

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	• eprodromou	T235270 Wikimedia API Gateway
Resolved	• eprodromou	T255030 Wikimedia API Gateway MVP
Resolved	hnowlan	T235277 Client Developer uses OAuth 2.0 for authorization
Resolved	• Pchelolo	T261428 Add support for iss claim in OAuth2 access tokens
Resolved	• Pchelolo	T261986 Upload WMF fork of oauth2-server to packagist and vendor it

Event Timeline

• Pchelolo created this task.Aug 27 2020, 4:19 PM

• Pchelolo moved this task from Backlog to Doing on the Platform Team Workboards (Green) board.

• Pchelolo renamed this task from Add support for its claim in OAuth2 access tokens to Add support for iss claim in OAuth2 access tokens.Aug 27 2020, 4:26 PM

• Pchelolo removed projects: Platform Team Sprints Board (Sprint 1), Story.

Strawman implementation of the library support https://github.com/wikimedia/oauth2-server/pull/1

I guess I'll do the whole thing myself and will ask @Clarakosi to test my code

Change 623430 had a related patch set uploaded (by Ppchelko; owner: Ppchelko):
[mediawiki/vendor@master] Update oauth2-server dependency

https://gerrit.wikimedia.org/r/623430

gerritbot added a project: Patch-For-Review.Aug 31 2020, 5:24 PM

Change 623434 had a related patch set uploaded (by Ppchelko; owner: Ppchelko):
[mediawiki/extensions/OAuth@master] Emit iss claims for oauth2 access token.

https://gerrit.wikimedia.org/r/623434

• Pchelolo updated the task description. (Show Details)Aug 31 2020, 8:45 PM

• Pchelolo moved this task from Doing to Waiting for Review on the Platform Team Workboards (Green) board.

• Pchelolo mentioned this in T261462: Migrate OAuth extension back from wikimedia/oauth2-server fork to upstream.

• Pchelolo moved this task from Waiting for Review to Ready to Deploy on the Platform Team Workboards (Green) board.Sep 2 2020, 3:48 PM

Change 623430 merged by jenkins-bot:
[mediawiki/vendor@master] Update oauth2-server dependency

https://gerrit.wikimedia.org/r/623430

Change 623434 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Emit iss claims for oauth2 access token.

https://gerrit.wikimedia.org/r/623434

ReleaseTaggerBot added a project: MW-1.36-notes (1.36.0-wmf.8; 2020-09-08).Sep 2 2020, 5:01 PM

• Pchelolo updated the task description. (Show Details)Sep 3 2020, 1:43 PM

WDoranWMF removed a subtask: T261986: Upload WMF fork of oauth2-server to packagist and vendor it.Sep 4 2020, 2:09 PM