k-space/dex
Archived
10
0
Fork 0
Code Issues Pull Requests Packages Projects Activity

Clarify the origin of openid-ca

Browse Source
This commit is contained in:
Erwin van Eyk 2019-08-14 15:18:34 +02:00 committed by erwinvaneyk
parent aeb2861a40
commit 5c99525ed3
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Documentation/kubernetes.md
View File

@ -43,6 +43,7 @@ Additional notes:
* Kubernetes only trusts ID Tokens issued to a single client. * Kubernetes only trusts ID Tokens issued to a single client.
* As a work around dex allows clients to [trust other clients][trusted-peers] to mint tokens on their behalf. * As a work around dex allows clients to [trust other clients][trusted-peers] to mint tokens on their behalf.
* If a claim other than "email" is used for username, for example "sub", it will be prefixed by `"(value of --oidc-issuer-url)#"`. This is to namespace user controlled claims which may be used for privilege escalation. * If a claim other than "email" is used for username, for example "sub", it will be prefixed by `"(value of --oidc-issuer-url)#"`. This is to namespace user controlled claims which may be used for privilege escalation.
* The `/etc/ssl/certs/openid-ca.pem` used here is the CA from the [generated TLS assets](#generate-tls-assets), and is assumed to be present on the cluster nodes.
## Deploying dex on Kubernetes ## Deploying dex on Kubernetes