Merge pull request #45317 from ericchiang/oidc-client-update

Automatic merge from submit-queue oidc client plugin: reduce round trips and fix scopes requested This PR attempts to simplify the OpenID Connect client plugin to reduce round trips. The steps taken by the client are now: * If ID Token isn't expired: * Do nothing. * If ID Token is expired: * Query /.well-known discovery URL to find token_endpoint. * Use an OAuth2 client and refresh token to request new ID token. This avoids the previous pattern of always initializing a client, which would hit the /.well-known endpoint several times. The client no longer does token validation since the server already does this. As a result, this code no longer imports github.com/coreos/go-oidc, instead just using golang.org/x/oauth2 for refreshing. Overall reduction in tests because we're not verify as many things on the client side. For example, we're no longer validating the id_token signature (again, because it's being done on the server side). This has been manually tested against dex, and I hope to continue to test this over the 1.7 release cycle. cc @mlbiam @frodenas @curtisallen @jsloyer @rithujohn191 @philips @kubernetes/sig-auth-pr-reviews ```release-note NONE ``` Updates https://github.com/kubernetes/kubernetes/issues/42654 Closes https://github.com/kubernetes/kubernetes/issues/37875 Closes https://github.com/kubernetes/kubernetes/issues/37874

Merge pull request #45317 from ericchiang/oidc-client-update
98128560 · Kubernetes Submit Queue · GitHub · ee0de5f3 · 6915f857 · 98128560
Commit 98128560 authored May 24, 2017 by Kubernetes Submit Queue Committed by GitHub May 24, 2017
3 changed files
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc/BUILD
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc/BUILD
@@ -13,12 +13,6 @@ go_test(
    srcs = ["oidc_test.go"],
    library = ":go_default_library",
    tags = ["automanaged"],
-    deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/key:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oauth2:go_default_library",
-        "//vendor/k8s.io/client-go/plugin/pkg/auth/authenticator/token/oidc/testing:go_default_library",
-    ],
 )

 go_library(
@@ -26,10 +20,8 @@ go_library(
    srcs = ["oidc.go"],
    tags = ["automanaged"],
    deps = [
-        "//vendor/github.com/coreos/go-oidc/jose:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oauth2:go_default_library",
-        "//vendor/github.com/coreos/go-oidc/oidc:go_default_library",
        "//vendor/github.com/golang/glog:go_default_library",
+        "//vendor/golang.org/x/oauth2:go_default_library",
        "//vendor/k8s.io/client-go/rest:go_default_library",
    ],
 )
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc.go
--- a/staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc_test.go
+++ b/staging/src/k8s.io/client-go/plugin/pkg/client/auth/oidc/oidc_test.go