Manage Token Issuer Allow/Deny Lists

ESS 3.0 Change

The Platform Management Service is the only service that accepts external OIDC tokens. All other ESS services exclusively trust ESS Access Tokens issued by the Platform Management service. Configure the allow/deny lists on the Platform Management service to control which Identity Providers are trusted.

The Platform Management Service can be configured with INRUPT_JWT_ISSUER_ALLOW_LIST and INRUPT_JWT_ISSUER_DENY_LIST to manage which external Identity Providers are trusted to issue tokens that can be exchanged for ESS Access Tokens.

How the Lists Work

• If INRUPT_JWT_ISSUER_ALLOW_LIST is set, the Platform service only accepts tokens from issuers in the list (subject to the deny list).

• If INRUPT_JWT_ISSUER_ALLOW_LIST is unset, the Platform service accepts tokens from all issuers (subject to the deny list).

• If INRUPT_JWT_ISSUER_DENY_LIST is set, the Platform service rejects tokens from those issuers, even if they appear in the allow list. The deny list always takes precedence.

Example: Update INRUPT_JWT_ISSUER_ALLOW_LIST

To restrict the Platform service to only accept tokens from specific Identity Providers:

1. Go to your ESS installation directory:

   cd ${HOME}/ess

2. Modify the kustomization.yaml (i.e., step 3 of the Applying Your Customizations procedure). Specifically, add the highlighted content to the kustomization.yaml file to the patches section:

   
    # kustomization.yaml in your ESS installation directory
    # ...  Preceding content omitted for brevity 
    # ...
    patches:
      - target:
          kind: Deployment
          name: ess-platform-management
        patch: |
          - op: add
            path: /spec/template/spec/containers/0/env/-
            value:
              name: INRUPT_JWT_ISSUER_ALLOW_LIST
              value: "https://login.example.com,https://accounts.google.com"
    
    

3. Continue with the rest of the Applying Your Customizations procedure.

Example: Update INRUPT_JWT_ISSUER_DENY_LIST

To block specific Identity Providers from being used for token exchange:

1. Go to your ESS installation directory:

   cd ${HOME}/ess

2. Modify the kustomization.yaml (i.e., step 3 of the Applying Your Customizations procedure). Specifically, add the highlighted content to the kustomization.yaml file to the patches section:

   
    # kustomization.yaml in your ESS installation directory
    # ...  Preceding content omitted for brevity 
    # ...
    patches:
      - target:
          kind: Deployment
          name: ess-platform-management
        patch: |
          - op: add
            path: /spec/template/spec/containers/0/env/-
            value:
              name: INRUPT_JWT_ISSUER_DENY_LIST
              value: "https://untrusted-idp.example.com"
    
    

3. Continue with the rest of the Applying Your Customizations procedure.