Support multiple audience for jwt authentication

[donggyu04]

Description

Related: #3723

Currently OpenSearch doesn't support multiple audience for JWT authentication.
I want to pass the audience claims if aud value in JWT is at least one of the required audiences.

For example, If I set my OpenSearch security configuration for JWT like below.
I want to pass verification if there is either project1 or admin audience in the JWT token.

This may be useful for some cases, like if someone need to access opensearch for all projects(project1, project2, ....) via admin aud.

required_audience: project1,admin

Please confirm this concept positively.
Thanks in advance.

Testing

I added unit tests.

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[willyborankin]

Hi @donggyu04, thank you. Could you please:

• add the related issue [FEATURE] required_audience should support a list #3723 to the description?
• run gradle spotlessCheck spotlessApply - to fix code formatting
• run gradle checkstyleMain checkstyleTest - to fix code style

[donggyu04]

@willyborankin

Yes, I fixed that you mentioned.

[codecov]

Codecov Report

Attention: Patch coverage is 78.57143% with 3 lines in your changes are missing coverage. Please review.

Project coverage is 65.46%. Comparing base (382bc5f) to head (a912c75).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4359   +/-   ##
=======================================
  Coverage   65.46%   65.46%           
=======================================
  Files         310      310           
  Lines       21986    21992    +6     
  Branches     3552     3554    +2     
=======================================
+ Hits        14393    14397    +4     
  Misses       5824     5824           
- Partials     1769     1771    +2     

Files	Coverage Δ
...ic/auth/http/jwt/AbstractHTTPJwtAuthenticator.java	60.43% <100.00%> (ø)
...azon/dlic/auth/http/jwt/keybyoidc/JwtVerifier.java	80.00% <80.00%> (+0.37%)	⬆️
...mazon/dlic/auth/http/jwt/HTTPJwtAuthenticator.java	73.58% <75.00%> (-0.68%)	⬇️

... and 2 files with indirect coverage changes

[willyborankin]

Could you please fix spotless scan failure:
https://github.com/opensearch-project/security/actions/runs/9184452058/job/25272008401?pr=4359

[cwperks]

Thank you for the contribution @donggyu04 ! The change looks good to me, but I had a general question.

When a user configures multiple values for required audience, it will behave as an OR operation where as long as a token has one of the required audiences its considered valid. Would there ever be a valid use-case where an admin would want to enforce that a jwt has all required audiences?

Can you please also submit a PR to the documentation-website to accompany this change?

[donggyu04]

@cwperks

Thank you for the contribution @donggyu04 ! The change looks good to me, but I had a general question.

When a user configures multiple values for required audience, it will behave as an OR operation where as long as a token has one of the required audiences its considered valid. Would there ever be a valid use-case where an admin would want to enforce that a jwt has all required audiences?

Can you please also submit a PR to the documentation-website to accompany this change?

Yes, I wanted to make sure that the JWT token was valid if it had any of the required audiences.

I can't think of any cases that force all required audience to be required. If I need to meet all required audience, I think I will use only one required audience as before.

I will make PR to documentation-website about this changes. thanks for your guidance

[donggyu04]

Could you please fix spotless scan failure: https://github.com/opensearch-project/security/actions/runs/9184452058/job/25272008401?pr=4359

@willyborankin

I fixed and check it again in my local machine. thanks

[donggyu04]

@willyborankin

test (citest, ubuntu-latest, 11) test was failed.
But looking at the error logs, it probably seems like a momentary failure.
I think it will pass if it tries again

Caused by: java.net.ConnectException: Connection refused (Connection refused)

...

java.net.BindException: Address already in use (Bind failed)

[willyborankin]

@willyborankin

test (citest, ubuntu-latest, 11) test was failed. But looking at the error logs, it probably seems like a momentary failure. I think it will pass if it tries again

Caused by: java.net.ConnectException: Connection refused (Connection refused)

...

java.net.BindException: Address already in use (Bind failed)

Yes it is a well known issue for the old test framework we use for testing. I will re-run jobs

[donggyu04]

@willyborankin

Test is failed again but, I don't know what the problem is.
It only has logs below about the error.

Process 'Gradle Test Executor 2' finished with non-zero exit value 255
This problem might be caused by incorrect test process configuration.
For more on test execution, please refer to https://docs.gradle.org/8.5/userguide/java_testing.html#sec:test_execution in the Gradle documentation.

[willyborankin]

@willyborankin

Test is failed again but, I don't know what the problem is. It only has logs below about the error.

Process 'Gradle Test Executor 2' finished with non-zero exit value 255
This problem might be caused by incorrect test process configuration.
For more on test execution, please refer to https://docs.gradle.org/8.5/userguide/java_testing.html#sec:test_execution in the Gradle documentation.

Yes I saw it as well. So far I can't answer the question why it happened.

[donggyu04]

@willyborankin @cwperks Thanks for reviews. Is this going to be included in what month's release?

[donggyu04]

@willyborankin @cwperks

Hi, Is this going to be included in what month's release?
Because our company is planning to use this feature.

Thanks in advance

[willyborankin]

Hi @donggyu04, yes it should be part of the upcoming release.

[donggyu04]

@willyborankin

Sorry for continuing to ask questions. When are you planning the next release? june or july?
Our deadline is July 15th, so I'm wondering if it will happen before that.

[willyborankin]

@donggyu04, here is the official release scheduler: https://opensearch.org/releases.html

[donggyu04]

@willyborankin Oh Thanks so much 👍