[Wimse] Re: Token Exchange design team update

[Evan Gilman <[e-mail]>]

On Thu, Jun 13, 2024 at 12:08 PM John Kemp <[e-mail]>
wrote:

> Just an attempt to understand this concretely, I thought I'd use the
> SPIRE-OIDC-AWSIAM example from the docs:
>
> 1. A SPIRE SVID JWT is issued to the workload at some point prior to the
> use of AWS S3, just via the normal SPIRE mechanisms.
>
> 2. Once OIDC discovery + IdP in AWS is setup, via OIDC discovery, the
> SPIRE OIDC provider provides an OpenID Connect ID Token to the AWS IdP,
> representing the workload, with the SVID url as its 'sub'. So this has
> been an actual token exchange (of a kind) from one format of JWT to
> another (let's forget there's probably barely any translation needed
> there).
>

A proper OpenID Connect ID Token never really exists. Communication between
AWS and SPIRE OIDC provider is limited to fetching of half-baked OIDC
well-known discovery doc and related JWKS.


> 3. Once the token has been obtained by the client, it can be used to go
> to S3, along with the request to 'assume role' based on that token.
>

Workload uses the JWT-SVID issued to it by SPIRE to directly call AWS STS
AssumeRoleWithWebIdentity. This endpoint matches issuer to do validation
(mentioned above), and can then apply policy against sub or other claims to
determine what role(s) the workload may assume.


> 4. The JWT is "translated" (and I think translation sounds more accurate
> than "exchange" here) to an IAM role (which concretely means AWS
> "temporary credentials" - but the client application never sees those
> effectively, so there is no "exchange" as such.
>
> So the overall protocol requires both an actual token exchange (not
> mediated by the client) and a translation.
>

There is only JWT-SVID issued to workload by SPIRE, and then resulting AWS
temporary credentials after AssumeRoleWithWebIdentity.

This is the same general pattern used for federated SPIFFE access into
Azure, GCP, and more. I hope this clarification is helpful , I'm no OIDC
expert, but I'm pretty sure it represents a departure from normal OIDC
flows.