Add JWT-SVID audience policy fields to Entry type by srikalyan · Pull Request #84 · spiffe/spire-api-sdk

srikalyan · 2025-12-26T05:45:09Z

Summary

Adds support for per-audience JWT-SVID policy configuration to the Entry type.

New JWTSVIDAudiencePolicy enum with three modes:

DEFAULT (0): No JTI claim, caching enabled. Backwards compatible behavior.
AUDITABLE (1): JTI claim included for audit trails, caching still enabled.
UNIQUE (2): JTI claim included, caching disabled. Each request gets a fresh token.

New Entry fields:

jwt_svid_default_audience_policy: Default policy for audiences not explicitly configured
jwt_svid_audience_policies: Map of audience → policy for per-audience overrides

New EntryMask fields:

jwt_svid_default_audience_policy
jwt_svid_audience_policies

Adds support for per-audience JWT-SVID policy configuration: New JWTSVIDAudiencePolicy enum with three modes: - DEFAULT (0): No JTI, caching enabled - AUDITABLE (1): JTI included, caching enabled - UNIQUE (2): JTI included, caching disabled New Entry fields: - jwt_svid_default_audience_policy: Default policy for audiences not in map - jwt_svid_audience_policies: Per-audience policy overrides New EntryMask fields for update operations.

This commit adds support for the new JWT-SVID audience policy configuration in the SPIRE server CLI and entry conversion logic: CLI changes: - Add -jwtSVIDDefaultAudiencePolicy flag for default audience policy - Add -jwtSVIDAudiencePolicy flag for per-audience policy configuration - Update entry create, update, and show commands to handle new fields - Add AudiencePolicyFlag custom type for parsing audience:policy pairs Entry conversion: - Add JwtSvidDefaultAudiencePolicy and JwtSvidAudiencePolicies to EntryToProto and ProtoToEntry conversion functions - Add audiencePolicyToInternal helper for enum conversion Policy options: default, auditable, unique - default: No JTI claim, caching enabled (current behavior) - auditable: JTI claim included, caching enabled - unique: JTI claim included, caching disabled (unique tokens) Part of spiffe#6043 NOTE: Only merge after these dependent PRs are merged: - spire-api-sdk: spiffe/spire-api-sdk#84 - spire-plugin-sdk: https://github.com/spiffe/spire-plugin-sdk/pull/113

This commit adds support for the new JWT-SVID audience policy configuration in the SPIRE server CLI and entry conversion logic: CLI changes: - Add -jwtSVIDDefaultAudiencePolicy flag for default audience policy - Add -jwtSVIDAudiencePolicy flag for per-audience policy configuration - Update entry create, update, and show commands to handle new fields - Add AudiencePolicyFlag custom type for parsing audience:policy pairs Entry conversion: - Add JwtSvidDefaultAudiencePolicy and JwtSvidAudiencePolicies to EntryToProto and ProtoToEntry conversion functions - Add audiencePolicyToInternal helper for enum conversion Policy options: default, auditable, unique - default: No JTI claim, caching enabled (current behavior) - auditable: JTI claim included, caching enabled - unique: JTI claim included, caching disabled (unique tokens) Part of spiffe#6043 NOTE: Only merge after these dependent PRs are merged: - spire-api-sdk: spiffe/spire-api-sdk#84 - spire: spiffe#6514

sorindumitru

Would you mind repointing this PR against the next branch? That's where changes go in first. We cherry-pick them to main once we make a release which includes the changes

This commit adds support for the new JWT-SVID audience policy configuration in the SPIRE server CLI and entry conversion logic: CLI changes: - Add -jwtSVIDDefaultAudiencePolicy flag for default audience policy - Add -jwtSVIDAudiencePolicy flag for per-audience policy configuration - Update entry create, update, and show commands to handle new fields - Add AudiencePolicyFlag custom type for parsing audience:policy pairs Entry conversion: - Add JwtSvidDefaultAudiencePolicy and JwtSvidAudiencePolicies to EntryToProto and ProtoToEntry conversion functions - Add audiencePolicyToInternal helper for enum conversion Policy options: default, auditable, unique - default: No JTI claim, caching enabled (current behavior) - auditable: JTI claim included, caching enabled - unique: JTI claim included, caching disabled (unique tokens) Part of spiffe#6043 NOTE: Only merge after these dependent PRs are merged: - spire-api-sdk: spiffe/spire-api-sdk#84 - spire: spiffe#6514

srikalyan · 2026-05-05T19:08:27Z

Superseded by #95, which implements the simpler design discussed in spiffe/spire#6514 (single bool jwt_svid_include_jti inside AdditionalAttributes). Closing.

This commit adds support for the new JWT-SVID audience policy configuration in the SPIRE server CLI and entry conversion logic: CLI changes: - Add -jwtSVIDDefaultAudiencePolicy flag for default audience policy - Add -jwtSVIDAudiencePolicy flag for per-audience policy configuration - Update entry create, update, and show commands to handle new fields - Add AudiencePolicyFlag custom type for parsing audience:policy pairs Entry conversion: - Add JwtSvidDefaultAudiencePolicy and JwtSvidAudiencePolicies to EntryToProto and ProtoToEntry conversion functions - Add audiencePolicyToInternal helper for enum conversion Policy options: default, auditable, unique - default: No JTI claim, caching enabled (current behavior) - auditable: JTI claim included, caching enabled - unique: JTI claim included, caching disabled (unique tokens) Part of spiffe#6043 NOTE: Only merge after these dependent PRs are merged: - spire-api-sdk: spiffe/spire-api-sdk#84 - spire: spiffe#6514

This commit adds support for the new JWT-SVID audience policy configuration in the SPIRE server CLI and entry conversion logic: CLI changes: - Add -jwtSVIDDefaultAudiencePolicy flag for default audience policy - Add -jwtSVIDAudiencePolicy flag for per-audience policy configuration - Update entry create, update, and show commands to handle new fields - Add AudiencePolicyFlag custom type for parsing audience:policy pairs Entry conversion: - Add JwtSvidDefaultAudiencePolicy and JwtSvidAudiencePolicies to EntryToProto and ProtoToEntry conversion functions - Add audiencePolicyToInternal helper for enum conversion Policy options: default, auditable, unique - default: No JTI claim, caching enabled (current behavior) - auditable: JTI claim included, caching enabled - unique: JTI claim included, caching disabled (unique tokens) Part of spiffe#6043 NOTE: Only merge after these dependent PRs are merged: - spire-api-sdk: spiffe/spire-api-sdk#84 - spire: spiffe#6514 Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com>

…iffe#6514) * Add JWT-SVID audience policy configuration with JTI claim support (spiffe#6043) Introduces per-audience JWT-SVID policy configuration to control JTI (JWT ID) claim inclusion and agent-side caching behavior. New JWTSVIDAudiencePolicy enum with three modes: - DEFAULT (0): No JTI, caching enabled (backwards compatible) - AUDITABLE (1): JTI included, caching enabled - UNIQUE (2): JTI included, caching disabled Features: - Per-entry default policy via jwt_svid_default_audience_policy - Per-audience overrides via jwt_svid_audience_policies map - "Most restrictive wins" for multi-audience tokens - Database schema v24 with entry_audience_policies table - Agent cache bypass for UNIQUE policy Note: API SDK and CLI integration will follow in a separate commit after spire-api-sdk is updated. Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> * Add CLI and entry conversion support for JWT-SVID audience policies This commit adds support for the new JWT-SVID audience policy configuration in the SPIRE server CLI and entry conversion logic: CLI changes: - Add -jwtSVIDDefaultAudiencePolicy flag for default audience policy - Add -jwtSVIDAudiencePolicy flag for per-audience policy configuration - Update entry create, update, and show commands to handle new fields - Add AudiencePolicyFlag custom type for parsing audience:policy pairs Entry conversion: - Add JwtSvidDefaultAudiencePolicy and JwtSvidAudiencePolicies to EntryToProto and ProtoToEntry conversion functions - Add audiencePolicyToInternal helper for enum conversion Policy options: default, auditable, unique - default: No JTI claim, caching enabled (current behavior) - auditable: JTI claim included, caching enabled - unique: JTI claim included, caching disabled (unique tokens) Part of spiffe#6043 NOTE: Only merge after these dependent PRs are merged: - spire-api-sdk: spiffe/spire-api-sdk#84 - spire: spiffe#6514 Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> * Bump spire-api-sdk to merged JTI commit (PR spiffe#95) Replaces local-path replace directive with the merged upstream SDK pseudo-version so CI can resolve the new jwt_svid_include_jti field from the public module proxy. Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> * Persist AdditionalAttributes through entry update mask The updateEntry mask translation in the entry v1 service was missing the AdditionalAttributes field, so masked updates targeting that field were silently dropped before reaching the datastore. Map the input mask bit through and add coverage for both the honored and ignored cases. Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> * Preserve sibling AdditionalAttributes on partial CLI entry update The protobuf AdditionalAttributes message has no per-field mask, so a CLI update that set only one of -disableX509SVIDPrefetch or -jwtSVIDIncludeJTI would clobber the unset sibling bit with its zero value. Track each flag's set state independently and, when exactly one is supplied (and -data is not in use), fetch the existing entry to merge the unspecified bit before BatchUpdateEntry. GetEntry failures short-circuit before any update is attempted. Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> * Address review feedback for JWT-SVID JTI claim - pkg/server/api/svid/v1/service.go: add explicit nil check for GetAdditionalAttributes() before reading JwtSvidIncludeJti; add test cases covering nil attrs, JTI false, and JTI true paths. - pkg/server/credtemplate/builder.go: return error from jti UUID generation instead of panicking via uuid.Must; encode the 16 random bytes as base64url for a more compact claim value. - cmd/spire-server/cli/entry/update.go: gate the existing-entry fetch on a single additionalAttributesSet flag, then merge each AdditionalAttributes field individually so unspecified flags preserve the existing value. - pkg/agent/manager/manager_test.go: add TestFetchJWTSVIDWithJTIBypassesCache proving JwtSvidIncludeJti bypasses both the cache read and write. - pkg/server/api/entry_test.go: only add JwtSvidIncludeJti: true in TestReadOnlyEntryClone; revert unintended prefetch change. Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> * Clone existing AdditionalAttributes on partial CLI entry update Switch mergeAdditionalAttributes to proto.Clone the existing message and override only fields explicitly set on the command line. This preserves unknown fields and any future AdditionalAttributes the binary does not know about, so the merge does not need editing when new fields are added. Also harden the agent's bypassCache read with a nil-safe chained getter. Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com> --------- Signed-off-by: Srikalyan Swayampakula <srikalyansswayam@gmail.com>

srikalyan requested review from MarcosDY, amartinezfayo, evan2645, rturner3 and sorindumitru as code owners December 26, 2025 05:45

This was referenced Dec 26, 2025

Add CLI and entry conversion support for JWT-SVID audience policies spiffe/spire#6516

Closed

Add CLI and entry conversion support for JWT-SVID audience policies srikalyan/spire#1

Closed

sorindumitru reviewed Apr 18, 2026

View reviewed changes

srikalyan mentioned this pull request Apr 21, 2026

Add jwt_svid_include_jti to Entry.AdditionalAttributes #95

Merged

2 tasks

srikalyan closed this May 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add JWT-SVID audience policy fields to Entry type - #84

Add JWT-SVID audience policy fields to Entry type#84
srikalyan wants to merge 1 commit into
spiffe:mainfrom
srikalyan:feature/jwt-svid-audience-policy

srikalyan commented Dec 26, 2025

Uh oh!

sorindumitru left a comment

Uh oh!

srikalyan commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

srikalyan commented Dec 26, 2025

Summary

New JWTSVIDAudiencePolicy enum with three modes:

New Entry fields:

New EntryMask fields:

Related

Uh oh!

sorindumitru left a comment

Choose a reason for hiding this comment

Uh oh!

srikalyan commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants