[MEDIUM] OCIS disables OIDC access token verification #23
Labels
No labels
area:documentation
area:infrastructure
area:network
area:security
priority:critical
priority:high
priority:low
priority:medium
status:blocked
type:bug
type:deployment
type:enhancement
type:investigation
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
reinitialized.net/infrastructure#23
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Labels: area:security, area:containers, priority:medium, type:bug
Description
In modules/secrets.example/apps3.nix:
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD = 'none'
This disables OIDC access token verification for ownCloud Infinite Scale.
Impact
Forged OIDC tokens could be used to gain unauthorized access to OCIS cloud storage. Any user who can craft a JWT could impersonate any user.
Recommended Fix
Set PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD to 'jwt' and configure proper JWKS endpoint validation against the Authentik issuer.