Chris Lu 641bea825d fix(iam): require non-empty issuer in OIDC discovery doc ...

The previous "doc.Issuer != "" && ..." guard let a discovery document
that omitted the issuer field bypass the issuer-mismatch check
entirely, letting the doc steer fetchJWKS at any URL it provided.
OIDC Discovery 1.0 §3 mandates the issuer field; treat missing as a
hard failure same as mismatched. Trailing-slash equivalence still
applies.

Adds TestDiscoveryRejectsMissingIssuer alongside the existing
TestDiscoveryRejectsIssuerMismatch via a new omitDiscoveryIssuer
toggle on fakeIDP.

2026-05-04 22:06:19 -07:00

..

mock_provider_test.go

go fix

2026-02-20 18:42:00 -08:00

mock_provider.go

S3 API: Advanced IAM System (#7160)

2025-08-30 11:15:48 -07:00

oidc_discovery_test.go

fix(iam): require non-empty issuer in OIDC discovery doc

2026-05-04 22:06:19 -07:00

oidc_provider_test.go

iam: add ECDSA support for OIDC token validation (#8166)

2026-01-29 20:03:43 -08:00

oidc_provider.go

fix(iam): require non-empty issuer in OIDC discovery doc

2026-05-04 22:06:19 -07:00