Repository navigation
fix: bind Microsoft native id_token issuer to its tid claim - #13
Merged
dmakarenko merged 1 commit intoSep 30, 2026
Merged
Conversation
Native Verify took the expected issuer from the token's own iss claim, so the issuer check compared the token with itself. A tenant set as microsoft_tenant was never enforced, and tokens whose iss did not match tid were accepted. Verify now requires a UUID tid and checks iss against https://login.microsoftonline.com/<tid>/v2.0, as the web flow does. A tenant set as a UUID is pinned (400 on mismatch, and the reason does not show the configured tenant, because this check runs before the signature check). common, organizations, consumers and domain names accept any tenant, so the production config (common) does not change. The unreachable payload-kid issuer lookup (fmt.Println, uncached http.Get on the default client) is deleted. The JWKS fetch now uses the registry HTTP client, because ClientContext is set before NewRemoteKeySet. Claude-Session: https://claude.ai/code/session_0192dFsdvVuQdqMdVxi9HDkz
dmakarenko
force-pushed
the
kratos-microsoft-verify-tid-issuer-20260930
branch
from
September 30, 2026 20:26
b940ea5 to
b885291
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Native Microsoft
Verifynow checksissagainsthttps://login.microsoftonline.com/<tid>/v2.0built from a UUIDtid, and pinsmicrosoft_tenantwhen it is a UUID.common/organizations/consumers/domain names accept any tenant. The dead payload-kidlookup (fmt.Println, uncachedhttp.Get) is deleted, and the JWKS fetch uses the registry HTTP client.Why: the expected issuer came from the token itself, so the issuer check compared the token with itself and a configured tenant was never enforced. Production uses
common, so valid v2 MSAL tokens are still accepted. v1sts.windows.nettokens are now rejected.Tested:
TestMicrosoft*19 pass / 0 fail on Go 1.26. The fullselfservice/strategy/oidcpackage gives 145 pass / 3 fail, and the 3 failures are the Hydra tests that need Docker (the same as the baseline). An Opus review found no blockers.https://claude.ai/code/session_0192dFsdvVuQdqMdVxi9HDkz