kbs/admin: add insecure_header_jwk configuration

Add insecure_header_jwk to bearer_jwt to control whether header-embedded
JWK keys must be endorsed via x5c before verifying admin JWT signatures.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>

Author: Xynnn007

kbs/docs/admin.md

@@ -79,7 +79,8 @@ This lets you keep identity issuance external while keeping KBS-side authorizati
 `[admin.authentication.bearer_jwt]` accepts:
 
 - `identity_providers` (array): list of trusted identity providers
-- `insecure_public_key_from_uri` (optional bool, default `false`): allow fetching verification keys over plaintext `http://`
+- `insecure_public_key_from_uri` (optional bool, default `false`): allow fetching verification keys over plaintext `http://`. Applies to configured `public_key_uri` and `jwk_set_uri` values, and to any `jwks_uri` returned by OpenID discovery for remote `jwk_set_uri` entries
+- `insecure_header_jwk` (optional bool, default `false`): skip endorsement checks for JWT header-embedded JWK keys (signature is still verified, testing only)
 
 Each `identity_providers` entry:
 

kbs/docs/config.md

@@ -276,7 +276,8 @@ For `authorization_mode = "AuthenticatedAuthorization"`, configure:
 | Property | Type | Description | Required | Default |
 |----------|------|-------------|----------|---------|
 | `identity_providers` | Array | Trusted issuer entries for JWT verification | No | Empty |
-| `insecure_public_key_from_uri` | Boolean | Allow loading admin verification keys via plaintext `http://` | No | `false` |
+| `insecure_public_key_from_uri` | Boolean | Allow loading admin verification keys via plaintext `http://`. Applies to configured URIs and any `jwks_uri` returned by OpenID discovery for remote `jwk_set_uri` entries. | No | `false` |
+| `insecure_header_jwk` | Boolean | Skip endorsement checks for header-embedded JWK keys. Signature is still verified; use only in controlled test environments. | No | `false` |
 
 Each `identity_providers` item:
 

kbs/src/admin/authentication/bearer_jwt.rs

@@ -21,9 +21,18 @@ pub struct BearerJwtConfig {
 
     /// Allow loading admin verification keys over plaintext HTTP.
     ///
-    /// When false, any HTTP fetch for key material is rejected. Keep disabled by default and only
-    /// enable in controlled environments.
+    /// When false, any HTTP fetch for key material is rejected: configured `public_key_uri`
+    /// and `jwk_set_uri` values, and any `jwks_uri` returned by OpenID discovery for remote
+    /// `jwk_set_uri` entries. Keep disabled by default and only enable in controlled environments.
     pub insecure_public_key_from_uri: bool,
+
+    /// Whether to skip endorsement checks of header-embedded JWK keys.
+    /// Signature is still verified.
+    /// This should only be set to true for testing.
+    ///
+    /// When false, header-embedded `jwk` keys must include an `x5c` certificate chain
+    /// that can be validated against configured trusted certificates (if any).
+    pub insecure_header_jwk: bool,
 }
 
 /// Issuer config used to verify admin JWT tokens.
@@ -77,7 +86,7 @@ impl BearerJwtTokenVerifier {
                 &trusted_jwk_set_uris,
                 &[],
                 &trusted_pem_public_key_uris,
-                false,
+                config.insecure_header_jwk,
                 config.insecure_public_key_from_uri,
             )
             .await
@@ -181,3 +190,32 @@ fn claims_from_value(value: Value) -> Result<Claims> {
 
     Ok(Claims { role })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::BearerJwtConfig;
+
+    #[test]
+    fn deserialize_insecure_header_jwk_true() {
+        let config: BearerJwtConfig = toml::from_str(
+            r#"
+            insecure_public_key_from_uri = true
+            insecure_header_jwk = true
+            identity_providers = [
+                { issuer = "admin", public_key_uri = "/etc/kbs-admin.pub" },
+            ]
+            "#,
+        )
+        .expect("valid bearer_jwt config");
+
+        assert!(config.insecure_header_jwk);
+        assert!(config.insecure_public_key_from_uri);
+        assert_eq!(config.identity_providers.len(), 1);
+    }
+
+    #[test]
+    fn default_insecure_header_jwk_false() {
+        let config = BearerJwtConfig::default();
+        assert!(!config.insecure_header_jwk);
+    }
+}