fm-orchestrator

#305 [audit-MUST] OIDC: Scope registration
Closed Opened by puiterwijk.

Closed
Reopen Issue

The "TODO" in auth.py says that you are awaiting scope registration.
Please note that you can register them yourself on https://fedoraproject.org/wiki/Infrastructure/Authentication.

OK, as a part of fixing #304 in #307 I found that I don't think we need to register a scope. We can use the existing groups scope and then just check if the user is in any of the required groups.

@ralph changed the status to Closed

I respectfully disagree with that statement.
You do need to register an OIDC scope.

The reason you need one is to make sure users explicitly authorize their client application to talk to FM-orchestrator.
So, you need to make sure the client tooling requests the scope you register, which means that a text like "MBS client wants to use the Modular Build Service" appears when the user authorizes the token.

This will make sure that a token that's been issued for other purposes (koji client, pkgdb client, ...) cannot be reused by an attacker or rogue service against the MBS.
Edited by puiterwijk

@puiterwijk changed the status to Open

Gotcha. Makes sense.

Metadata Update from @ralph:
- Issue assigned to ralph

Fixed in #338.

Metadata Update from @ralph:
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/mbs/issues/305

Please continue any further discussion there.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.