conv.

All stories
Active · 38h

GitHub Actions needs OIDC audience constraints

GitHub Actions needs OIDC audience constraints
security

Conversation activity · last 39 hours peak 3/hr

Peak 3 items in one hour at Aug 10, 2 PM; 18 items over 39 hours Aug 10, 8 AM — 3 items · Hacker News 1, Lobsters 1, Mastodon 1Aug 10, 9 AM — no itemsAug 10, 10 AM — no itemsAug 10, 11 AM — no itemsAug 10, 12 PM — no itemsAug 10, 1 PM — 1 item · Lobsters 1Aug 10, 2 PM — 3 items · Lobsters 3Aug 10, 3 PM — 1 item · Lobsters 1Aug 10, 4 PM — no itemsAug 10, 5 PM — 1 item · Lobsters 1Aug 10, 6 PM — no itemsAug 10, 7 PM — no itemsAug 10, 8 PM — no itemsAug 10, 9 PM — no itemsAug 10, 10 PM — no itemsAug 10, 11 PM — no itemsAug 11, 12 AM — 2 items · Lobsters 2Aug 11, 1 AM — 1 item · Lobsters 1Aug 11, 2 AM — no itemsAug 11, 3 AM — no itemsAug 11, 4 AM — no itemsAug 11, 5 AM — 1 item · Lobsters 1Aug 11, 6 AM — 1 item · Hacker News 1Aug 11, 7 AM — no itemsAug 11, 8 AM — 1 item · Lobsters 1Aug 11, 9 AM — 2 items · Lobsters 2Aug 11, 10 AM — no itemsAug 11, 11 AM — no itemsAug 11, 12 PM — 1 item · Lobsters 1Aug 11, 1 PM — no itemsAug 11, 2 PM — no itemsAug 11, 3 PM — no itemsAug 11, 4 PM — no itemsAug 11, 5 PM — no itemsAug 11, 6 PM — no itemsAug 11, 7 PM — no itemsAug 11, 8 PM — no itemsAug 11, 9 PM — no itemsAug 11, 10 PM — no items 3 items · 2 PM
4 PMAug 118 AM4 PMnow · 11:50 PM

Clustered from 18 items across 3 sources. Not yet parsed — the coverage below is the raw record.

Social posts 3

Voices from the web unedited

  • I’ll force the knowledge onto you. OpenID is a consortium that, once upon a time, proposed a standard of the same name for a system of “federated Identity Providers” - effectively a combination of SSO and external sign in providers that you see when you have “Sign In with Google” or whatever. OpenID Connect kind of fits this niche? But it’s…

    cephsecurity1d ago16▲view on Lobsters ↗
  • GH Actions security is kinda rickety. If you want to prevent i.e. untrusted public users from being able to i.e. use a specific runner, there is no way to do so other than Actions files in the repo, which are attacker controlled anyways. It's pretty annoying for self-hosted public runners! One solution would be i.e. restrict allowed branches to…

    calvinsecurity1d ago6▲view on Lobsters ↗
  • I've always wondered what OpenID is and why everyone only seems to talk about the Connect part, whatever that is. Not wondered enough to research it, mind you.

    mortsecurity1d ago6▲view on Lobsters ↗
  • Essentially, it’s a poorly designed identity layer on top of OAuth 2.0 protocol based on JWTs. Easy to self-host a provider server, but in practice each one of them has its own quirks and inconveniences that the clients have to be aware of…

    heavyrain266security1d ago4▲view on Lobsters ↗
  • One of the unstated annoyances here is a few cloud providers don't support inspecting anything other than `iss`, `sub`, and `aud` - so you can't actually use the extra OIDC claims GitHub provides[[0]] and effectively have to rely on org/repo for identity. Notably, AWS largely can't read anything other than the aforementioned three unless you use a…

    unlobitosecurity17h ago3▲view on Lobsters ↗
  • Seems pretty reasonable. I loosely (i.e. not a dedicated issue yet) suggested this to Forgejo ([which added workload identity support in v15](

    oliverpoolsecurity1d ago2▲view on Lobsters ↗
  • If GHA's `sub` isn't sufficient, isn't the solution to push for `sub` enhancements (or additional metadata in custom claims) rather than trying to elevate `aud`?

    alexjurkiewiczsecurity22h ago2▲view on Lobsters ↗
  • Or the workflow name claim, or environments, or a combination of aud, sub, and workflow, etc. (Does anyone rely on aud only?) OP does recognize this (“_came to the conclusion that the machine identity […] must include the workflow name_”) and hints at the real problem: “_many integrations want to use just the org/repo slug as a sufficient…

    bureadosecurity22h ago1▲view on Lobsters ↗
  • I’d also like to see declarative aud, but I can kind of see why that one was left to Actions publishers to choose, instead of equipping the STS with the mapping and starting to reject token signing requests, breaking CI. Ultimately in those cases it seems to me that aud _is_ fixed, it’s just fixed to an action’s version as opposed to the…

    bureadosecurity13h ago1▲view on Lobsters ↗
  • Nobody (including me, the OP) is saying you should rely solely on the audience claim! The audience is *not* an alternative to properly identifying the principal for the ID token. The only point of the post is that GitHub’s ID token generation is more flexible than is ideal. Audiences should be fixed to make it harder to an attacker to pivot…

    yossariansecurity13h ago1▲view on Lobsters ↗