mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-19 05:50:41 +08:00
Seth Jennings
5206bc51b2
* feat(sdk): add renewable client credentials auth Implement lazy OAuth client-credentials acquisition and renewal for the Python, TypeScript, and Go SDK clients, with shared security conformance coverage and service-account documentation.\n\nCloses #2803 Signed-off-by: Seth Jennings <sjenning@redhat.com> * fix(sdk): address client credentials review Signed-off-by: Seth Jennings <sjenning@redhat.com> * fix(sdk): address client credentials review Signed-off-by: Seth Jennings <sjenning@redhat.com> --------- Signed-off-by: Seth Jennings <sjenning@redhat.com>
45 lines
1.2 KiB
JSON
45 lines
1.2 KiB
JSON
{
|
|
"request": {
|
|
"grant_type": "client_credentials",
|
|
"client_id": "service-client",
|
|
"client_secret": "conformance-secret",
|
|
"scopes": ["sandbox:read", "sandbox:write"],
|
|
"scope": "sandbox:read sandbox:write",
|
|
"audience": "openshell-gateway",
|
|
"forbidden_implicit_scopes": ["openid", "profile", "email"]
|
|
},
|
|
"expiry": {
|
|
"leeway_seconds": 30,
|
|
"valid_expires_in": 120,
|
|
"invalid_expires_in": [0, -1, "NaN", null]
|
|
},
|
|
"discovery": {
|
|
"configured_issuer": "https://issuer.example.com",
|
|
"matching_issuer": "https://issuer.example.com/",
|
|
"mismatched_issuer": "https://attacker.example.com",
|
|
"redirect_statuses": [301, 302, 307, 308]
|
|
},
|
|
"limits": {
|
|
"max_response_bytes": 1048576
|
|
},
|
|
"urls": {
|
|
"allowed": [
|
|
"https://issuer.example.com",
|
|
"http://localhost:8080",
|
|
"http://127.0.0.1:8080",
|
|
"http://127.42.0.1:8080",
|
|
"http://[::1]:8080"
|
|
],
|
|
"rejected": [
|
|
"http://issuer.example.com",
|
|
"https://user@issuer.example.com",
|
|
"https://issuer.example.com/#fragment"
|
|
]
|
|
},
|
|
"redaction": {
|
|
"secret": "conformance-secret",
|
|
"supplier_error": "supplier-sensitive-detail",
|
|
"provider_body": "provider-sensitive-detail"
|
|
}
|
|
}
|