GitHub Actions needs OIDC audience constraints
Conversation activity · last 39 hours peak 3/hr
Clustered from 18 items across 3 sources. Not yet parsed — the coverage below is the raw record.
Social posts 3
Voices from the web unedited
-
I’ll force the knowledge onto you. OpenID is a consortium that, once upon a time, proposed a standard of the same name for a system of “federated Identity Providers” - effectively a combination of SSO and external sign in providers that you see when you have “Sign In with Google” or whatever. OpenID Connect kind of fits this niche? But it’s…
-
GH Actions security is kinda rickety. If you want to prevent i.e. untrusted public users from being able to i.e. use a specific runner, there is no way to do so other than Actions files in the repo, which are attacker controlled anyways. It's pretty annoying for self-hosted public runners! One solution would be i.e. restrict allowed branches to…
-
I've always wondered what OpenID is and why everyone only seems to talk about the Connect part, whatever that is. Not wondered enough to research it, mind you.
-
Essentially, it’s a poorly designed identity layer on top of OAuth 2.0 protocol based on JWTs. Easy to self-host a provider server, but in practice each one of them has its own quirks and inconveniences that the clients have to be aware of…
-
One of the unstated annoyances here is a few cloud providers don't support inspecting anything other than `iss`, `sub`, and `aud` - so you can't actually use the extra OIDC claims GitHub provides[[0]] and effectively have to rely on org/repo for identity. Notably, AWS largely can't read anything other than the aforementioned three unless you use a…
-
Seems pretty reasonable. I loosely (i.e. not a dedicated issue yet) suggested this to Forgejo ([which added workload identity support in v15](
-
If GHA's `sub` isn't sufficient, isn't the solution to push for `sub` enhancements (or additional metadata in custom claims) rather than trying to elevate `aud`?
-
Or the workflow name claim, or environments, or a combination of aud, sub, and workflow, etc. (Does anyone rely on aud only?) OP does recognize this (“_came to the conclusion that the machine identity […] must include the workflow name_”) and hints at the real problem: “_many integrations want to use just the org/repo slug as a sufficient…
-
I’d also like to see declarative aud, but I can kind of see why that one was left to Actions publishers to choose, instead of equipping the STS with the mapping and starting to reject token signing requests, breaking CI. Ultimately in those cases it seems to me that aud _is_ fixed, it’s just fixed to an action’s version as opposed to the…
-
Nobody (including me, the OP) is saying you should rely solely on the audience claim! The audience is *not* an alternative to properly identifying the principal for the ID token. The only point of the post is that GitHub’s ID token generation is more flexible than is ideal. Audiences should be fixed to make it harder to an attacker to pivot…