[
https://issues.apache.org/jira/browse/IMPALA-12232?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jason Fehr updated IMPALA-12232:
--------------------------------
Description:
RFC 8725 contains JWT best practices that state the audience ("AUD") and issuer
("ISS") claims from a JWT should be validated if they are present. Impala
currently has no mechanism to validate these claims.
Implement [ISS claim
validation|https://datatracker.ietf.org/doc/html/rfc8725#name-validate-issuer-and-subject]
and [AUD claim
validation|https://datatracker.ietf.org/doc/html/rfc8725#name-use-and-validate-audience]
for both JWT and OAuth tokens.
was:
RFC 8725 contains JWT best practices that state the audience ("AUD") and issuer
("ISS") claims from a JWT should be validated if they are present. Impala
currently has no mechanism to validate these claims.
Implement [ISS claim
validation|https://datatracker.ietf.org/doc/html/rfc8725#name-validate-issuer-and-subject]
and [AUD claim
validation|https://datatracker.ietf.org/doc/html/rfc8725#name-use-and-validate-audience].
> Verify JWT Audience and Issuer Claims
> -------------------------------------
>
> Key: IMPALA-12232
> URL: https://issues.apache.org/jira/browse/IMPALA-12232
> Project: IMPALA
> Issue Type: Improvement
> Components: Backend, Security
> Reporter: Jason Fehr
> Assignee: Jason Fehr
> Priority: Major
> Labels: Impala, JWT, impala, jwt, security
>
> RFC 8725 contains JWT best practices that state the audience ("AUD") and
> issuer ("ISS") claims from a JWT should be validated if they are present.
> Impala currently has no mechanism to validate these claims.
> Implement [ISS claim
> validation|https://datatracker.ietf.org/doc/html/rfc8725#name-validate-issuer-and-subject]
> and [AUD claim
> validation|https://datatracker.ietf.org/doc/html/rfc8725#name-use-and-validate-audience]
> for both JWT and OAuth tokens.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
