kbs: add http config to fetch token verification key for admin

In dev cases, this patch allows users to configure KBS to get admin
token verification public key from HTTP endpoint.

Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>

Author: Xynnn007

kbs/docs/admin.md

@@ -79,6 +79,7 @@ This lets you keep identity issuance external while keeping KBS-side authorizati
 `[admin.authentication.bearer_jwt]` accepts:
 
 - `identity_providers` (array): list of trusted identity providers
+- `insecure_public_key_from_uri` (optional bool, default `false`): allow fetching`public_key_uri` and `jwk_set_uri` over `http://`
 
 Each `identity_providers` entry:
 
@@ -92,5 +93,6 @@ Each entry must provide at least one of `public_key_uri` or `jwk_set_uri`.
 Supported source formats:
 
 - `https://...` (remote fetch)
+- `http://...` (remote fetch, only when `insecure_public_key_from_uri=true`)
 - `file://...` (local file URI)
 - local path without scheme (for example `./keys/admin.pem`)

kbs/docs/config.md

@@ -192,18 +192,24 @@ For `authorization_mode = "AuthenticatedAuthorization"`, configure:
 | Property | Type | Description | Required | Default |
 |----------|------|-------------|----------|---------|
 | `identity_providers` | Array | Trusted issuer entries for JWT verification | No | Empty |
+| `insecure_public_key_from_uri` | Boolean | Allow loading `public_key_uri` via plaintext `http://` | No | `false` |
 
 Each `identity_providers` item:
 
 | Property | Type | Description | Required |
 |----------|------|-------------|----------|
 | `issuer` | String | Expected JWT `iss` value (leave empty to skip issuer check) | No |
 | `audience` | String | Expected JWT `aud` value (leave empty to skip audience check) | No |
-| `public_key_uri` | String | PEM public key source (`https://`, `file://`, local path) | No* |
+| `public_key_uri` | String | PEM public key source (`https://`, `file://`, local path, or `http://` when `insecure_public_key_from_uri=true`) | No* |
 | `jwk_set_uri` | String | JWKS source (`https://`, `file://`, or local path) | No* |
 
 \* At least one of `public_key_uri` or `jwk_set_uri` is required.
 
+> [!NOTE]
+> When `insecure_public_key_from_uri=false` the KBS will allow to fetch public keys from a non-HTTPS server.
+> Ensure this only happens in controlled network environment or dev case, or there will be
+> security risk.
+
 JWTs used for admin access **MUST** include a `role` claim.
 
 `regex_acl` properties:

kbs/src/admin/authentication/bearer_jwt.rs

@@ -18,11 +18,15 @@ use crate::crypto::jwt::JwtVerifier;
 #[serde(default, deny_unknown_fields)]
 pub struct BearerJwtConfig {
     pub identity_providers: Vec<IssuerConfig>,
+    /// Allow loading admin PEM keys from plaintext HTTP sources.
+    /// Keep disabled by default and only enable in controlled environments.
+    pub insecure_public_key_from_uri: bool,
 }
 
 /// Issuer config used to verify admin JWT tokens.
 ///
-/// - `public_key_uri`: a PEM file source (`https://`, `file://`, local path)
+/// - `public_key_uri`: a PEM file source (`https://`, `file://`, local path,
+///   or `http://` when `insecure_public_key_from_uri=true`)
 /// - `jwk_set_uri`: a JWKS source (https://, file:// or local path)
 /// - `issuer`: the issuer of the JWT token. If given, This field will be checked when a token is verified successfully
 ///   with given public key or JWKS. If the token's issuer is matched, the token will be verified successfully.
@@ -69,6 +73,7 @@ impl BearerJwtTokenVerifier {
                 &[],
                 &trusted_pem_public_key_uris,
                 false,
+                config.insecure_public_key_from_uri,
             )
             .await
             .map_err(|e| Error::InvalidTokenVerifierConfig(e.to_string()))?;

kbs/src/attestation/intel_trust_authority/mod.rs

@@ -449,6 +449,7 @@ impl IntelTrustAuthority {
             &trusted_certs_paths,
             &trusted_pem_public_keys,
             true,
+            false,
         )
         .await
         .context("Failed to initialize token verifier")?;

kbs/src/crypto/jwk.rs

@@ -7,7 +7,7 @@ use reqwest::{get, Url};
 use serde::Deserialize;
 use std::fs;
 use thiserror::Error;
-use tracing::info;
+use tracing::{info, warn};
 
 pub(crate) const OPENID_CONFIG_URL_SUFFIX: &str = ".well-known/openid-configuration";
 
@@ -29,19 +29,25 @@ pub(crate) struct OpenIDConfig {
     jwks_uri: String,
 }
 
-pub async fn read_jwk_from_uri(uri: &str) -> Result<JwkSet, JwksGetError> {
+pub async fn read_jwk_from_uri(
+    uri: &str,
+    insecure_public_key_from_uri: bool,
+) -> Result<JwkSet, JwksGetError> {
     let url = Url::parse(uri).map_err(|e| JwksGetError::InvalidSourcePath(e.to_string()))?;
     match url.scheme() {
-        "https" => {
+        "https" | "http" if insecure_public_key_from_uri => {
             let openid_config_url = url
                 .join(OPENID_CONFIG_URL_SUFFIX)
                 .map_err(|e| JwksGetError::InvalidSourcePath(e.to_string()))?;
 
+            if url.scheme() == "http" {
+                warn!("Getting OpenID configuration from insecure HTTP source, please ensure the source is trusted or it's only used in a controlled/test environment");
+            }
+
             info!(
                 "Getting OpenID configuration from {}",
                 openid_config_url.as_str()
             );
-
             let oidc = get(openid_config_url.as_str())
                 .await
                 .map_err(|e| JwksGetError::AccessFailed(e.to_string()))?
@@ -88,7 +94,10 @@ mod tests {
     #[case("/does/not/exist/keys.jwks", true)]
     #[tokio::test]
     async fn test_source_path_validation(#[case] source_path: &str, #[case] expect_error: bool) {
-        assert_eq!(expect_error, read_jwk_from_uri(source_path).await.is_err())
+        assert_eq!(
+            expect_error,
+            read_jwk_from_uri(source_path, false).await.is_err()
+        )
     }
 
     #[rstest]
@@ -108,7 +117,7 @@ mod tests {
         std::fs::write(&jwks_file, json).expect("to get testdata written to tmpdir");
 
         let p = "file://".to_owned() + jwks_file.to_str().expect("to get path as str");
-        let jwtks = read_jwk_from_uri(&p).await.expect("to get jwks");
+        let jwtks = read_jwk_from_uri(&p, false).await.expect("to get jwks");
         assert_eq!(jwtks.keys.len(), 1);
         assert_eq!(jwtks.keys[0].common.key_algorithm, Some(alg));
     }

kbs/src/crypto/jwt.rs

@@ -36,7 +36,10 @@ fn path_to_file_uri(path: &str) -> Result<String> {
 }
 
 fn normalize_jwk_set_source(source: &str) -> Result<String> {
-    if source.starts_with("https://") || source.starts_with("file://") {
+    if source.starts_with("https://")
+        || source.starts_with("http://")
+        || source.starts_with("file://")
+    {
         return Ok(source.to_string());
     }
 
@@ -47,12 +50,21 @@ fn normalize_jwk_set_source(source: &str) -> Result<String> {
     path_to_file_uri(source)
 }
 
-/// Read a PEM public key from a URI (`https://`, `file://`, or local path).
-pub(crate) async fn read_pem_public_key_from_uri(uri: &str) -> Result<DecodingKey> {
+/// Read a PEM public key from a URI.
+///
+/// # Arguments
+///
+/// * `uri` - The URI of the PEM public key.
+/// * `allow_insecure_http` - Whether to allow HTTP address as uri.
+pub(crate) async fn read_pem_public_key_from_uri(
+    uri: &str,
+    allow_insecure_http: bool,
+) -> Result<DecodingKey> {
     let maybe_url = Url::parse(uri);
     let data = if let Ok(url) = maybe_url {
         match url.scheme() {
             "https" => reqwest::get(uri).await?.bytes().await?.to_vec(),
+            "http" if allow_insecure_http => reqwest::get(uri).await?.bytes().await?.to_vec(),
             "file" => std::fs::read(url.path())?,
             _ => {
                 bail!("unsupported scheme in {uri}");
@@ -127,16 +139,18 @@ impl JwtVerifier {
     /// * `trusted_cert_paths` - The paths of the trusted certificates.
     /// * `trusted_pem_public_key_uris` - The URIs of the trusted PEM public keys.
     /// * `insecure_public_key_from_jwt` - Whether to verify the endorsement of the public key from JWT header.
+    /// * `insecure_public_key_from_uri` - Whether to allow insecure HTTP address in trusted_pem_public_key_uris.
     pub async fn new(
         trusted_jwk_set_uris: &[String],
         trusted_cert_paths: &[String],
         trusted_pem_public_key_uris: &[String],
         insecure_public_key_from_jwt: bool,
+        insecure_public_key_from_uri: bool,
     ) -> Result<Self> {
         let mut trusted_jwk_sets = JwkSet { keys: Vec::new() };
         for uri in trusted_jwk_set_uris {
             let uri = normalize_jwk_set_source(&uri[..])?;
-            let mut jwk_set = read_jwk_from_uri(&uri[..]).await?;
+            let mut jwk_set = read_jwk_from_uri(&uri[..], insecure_public_key_from_uri).await?;
             trusted_jwk_sets.keys.append(&mut jwk_set.keys);
         }
 
@@ -156,7 +170,8 @@ impl JwtVerifier {
 
         let mut trusted_pem_public_keys = Vec::new();
         for uri in trusted_pem_public_key_uris {
-            let public_key = read_pem_public_key_from_uri(uri).await?;
+            let public_key =
+                read_pem_public_key_from_uri(uri, insecure_public_key_from_uri).await?;
             trusted_pem_public_keys.push(public_key);
         }
 
@@ -356,7 +371,7 @@ mod tests {
 
         use crate::crypto::jwt::JwtVerifier;
 
-        let verifier = JwtVerifier::new(&[], &[trusted_pem_path.to_string()], &[], false)
+        let verifier = JwtVerifier::new(&[], &[trusted_pem_path.to_string()], &[], false, false)
             .await
             .expect("verifier init");
         let jwk_json = std::fs::read_to_string(jwk_json_path).expect("read jwk json");

kbs/src/token/mod.rs

@@ -77,6 +77,7 @@ impl TokenVerifier {
             &config.trusted_certs_paths,
             &Vec::new(),
             config.insecure_key,
+            false,
         )
         .await
         .map_err(|e| Error::TokenVerifierInitialization { source: e })?;