-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Keycloak support for public clients and device flow (enables sigstore) #509
Comments
I discussed The second part does make sense. A "client without a secret" is a "public" client in Keycloak terms (in contrast to a "confidential" client). The pepr UDS operator could be extended to support this. This is fine... but we really do need to review the impact of introducing "public" clients into UDS. They really don't make any thing worse but do kind of make some existing bugs easier to exploit.
|
Added to the SWF board as well in case we get to it - this isn't the main use case for sigstore but it is a nice thing to enable for flexibility for users. |
Is your feature request related to a problem? Please describe.
As Kay I want to have Sigstore integrated with Keycloak so that I can sign images, git commits and more without needing to manage keys
Describe the solution you'd like
cosign sign
with the fulcio, rekor, and oidc-issuer urlsDescribe alternatives you've considered
We could not integrate with Keycloak directly and instead use something like Dex to issue the id tokens: https://dexidp.io/
Additional context
Currently the uds-core operator does not allow the creation of clients without a client secret.
The text was updated successfully, but these errors were encountered: