Accepting signed JWTs as authentication

[stensonb]

Hi there -

I'm looking to use Gitlab's CI_JOB_JWT to authenticate (https://docs.gitlab.com/ee/ci/secrets/), but am having a difficult time wrapping my head around how this might work with Ory Hydra.

     ┌─────┐                            ┌──────┐          ┌──────────┐                    ┌────────────┐
     │Hydra│                            │Gitlab│          │Kubernetes│                    │GitlabRunner│
     └──┬──┘                            └──┬───┘          └────┬─────┘                    └─────┬──────┘
        │Get JWKS (for CI_JOB_JWTs) details│                   │                                │       
        │──────────────────────────────────>                   │                                │       
        │                                  │                   │                                │       
        │       Return JWKS details        │                   │                                │       
        │<──────────────────────────────────                   │                                │       
        │                                  │                   │                                │       
        │      Get JWKS (for Hydra IdP id_tokens) details      │                                │       
        │<──────────────────────────────────────────────────────                                │       
        │                                  │                   │                                │       
        │                 Return JWKS details                  │                                │       
        │──────────────────────────────────────────────────────>                                │       
        │                                  │                   │                                │       
        │                                  │                   assigns CI job                   │       
        │                                  │ ───────────────────────────────────────────────────>       
        │                                  │                   │                                │       
        │                             authenticate with CI_JOB_JWT                              │       
        │<───────────────────────────────────────────────────────────────────────────────────────       
        │                                  │                   │                                │       
        ────┐                              │                   │                                │       
            │ validate CI_JOB_JWT          │                   │                                │       
        <───┘                              │                   │                                │       
        │                                  │                   │                                │       
        │                                  │    id_token       │                                │       
        │───────────────────────────────────────────────────────────────────────────────────────>       
        │                                  │                   │                                │       
        │                                  │                   │   Kube API call with id_token  │       
        │                                  │                   │ <───────────────────────────────       
        │                                  │                   │                                │       
        │                                  │                   │────┐                                   
        │                                  │                   │    │ validate id_token with JWKS       
        │                                  │                   │<───┘                                   
        │                                  │                   │                                │       
        │                                  │                   │────┐                           │       
        │                                  │                   │    │ perform API call          │       
        │                                  │                   │<───┘                           │       
        │                                  │                   │                                │       
        │                                  │                   │     Kube API call response     │       
        │                                  │                   │ ───────────────────────────────>       
        │                                  │                   │                                │       
        │                                  │               returns CI job details               │       
        │                                  │ <───────────────────────────────────────────────────       
     ┌──┴──┐                            ┌──┴───┐          ┌────┴─────┐                    ┌─────┴──────┐
     │Hydra│                            │Gitlab│          │Kubernetes│                    │GitlabRunner│
     └─────┘                            └──────┘          └──────────┘                    └────────────┘

I know I need to:

1. Register a client for kubernetes to use (in order to get correct JWKS details)
2. Update/modify/configure Ory Hydra to accept JWTs from GitlabRunner (with JWKS details to verify).

But, I'm confused about Step 2. Is this "JWT Authentication" mechanism supported in Hydra?

[stensonb]

Is this the upcoming feature in #2384 ?

[aeneasr]

I believe so!

[vinckr]

Since the feature has been released for some time, I mark this as answered.
Feel free still add to this discussion however.