Filter identity token keys

[fairclothjm]

Description

Filter the keys published at the /keys endpoint for identity tokens in use by roles. Right now, if keys are created for the OIDC provider, they’ll be published at /keys for identity tokens even if they’re not used by that system.

Manual Testing

Test script

getkeys() {
  echo
  echo "====================="
  echo "oidc/.well-known/keys"

  curl -s \
    -X GET \
    http://127.0.0.1:8200/v1/identity/oidc/.well-known/keys \
    | jq -r ".keys[].kid"

  echo
  echo "====================="
  echo "oidc/provider/provider1/.well-known/keys"

  curl -s \
    -X GET \
    -H "X-Vault-Token: root" \
    http://127.0.0.1:8200/v1/identity/oidc/provider/provider1/.well-known/keys \
    | jq -r ".keys[]?.kid"

  echo
}

# should be returned by the `oidc/.well-known/keys` endpoint
vault write identity/oidc/key/key1 rotation_period=2m verification_ttl=2m
vault write identity/oidc/role/role1 key=key1 ttl=1m

getkeys


# should be returned by the `oidc/provider/<PROVIDER>/.well-known/keys` endpoint
vault write identity/oidc/key/key2 rotation_period=2m verification_ttl=2m
vault write identity/oidc/client/client1 \
  key=key2 \
  id_token_ttl=1m \
  access_token_ttl=1m
vault write identity/oidc/provider/provider1 \
    allowed_client_ids="*"

getkeys

Output

Success! Data written to: identity/oidc/key/key1
Success! Data written to: identity/oidc/role/role1

=====================
oidc/.well-known/keys
a5cf885d-0414-5e6a-65ea-6ca00727faef
e618fe98-b406-b974-3ad2-fea5e8e5e510

=====================
oidc/provider/provider1/.well-known/keys

Success! Data written to: identity/oidc/key/key2
Success! Data written to: identity/oidc/client/client1
Success! Data written to: identity/oidc/provider/provider1

=====================
oidc/.well-known/keys
a5cf885d-0414-5e6a-65ea-6ca00727faef
e618fe98-b406-b974-3ad2-fea5e8e5e510

=====================
oidc/provider/provider1/.well-known/keys
1d71e84f-c781-3f24-15bb-90a68a8a41fb
65f28c36-e38e-84dc-0a8e-51547ae8ba0f

[austingebauer]

Looks good! Had an idea for an alternative approach. Let me know your thoughts.

[vinay-gopalan]

I agree with Austin's suggested optimization, but looks good to me otherwise!

[austingebauer]

One comment on changelog. Otherwise, LGTM 👍