From 9b5ce5218fb407165a5be584497999c9c80bfdbe Mon Sep 17 00:00:00 2001 From: Eric Chiang Date: Thu, 11 Aug 2016 09:41:50 -0700 Subject: [PATCH] pkg/apiserver/authenticator: move oidc after service accounts Both plugins verify JWTs, but the OpenID Connect plugin performs much worse when faced with cache misses. Reorder the plugins so the service account plugin tries to authenticate a bearer token first. --- pkg/apiserver/authenticator/authn.go | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/pkg/apiserver/authenticator/authn.go b/pkg/apiserver/authenticator/authn.go index feba1dbef8..12523fadb9 100644 --- a/pkg/apiserver/authenticator/authn.go +++ b/pkg/apiserver/authenticator/authn.go @@ -80,14 +80,6 @@ func New(config AuthenticatorConfig) (authenticator.Request, error) { authenticators = append(authenticators, tokenAuth) } - if len(config.OIDCIssuerURL) > 0 && len(config.OIDCClientID) > 0 { - oidcAuth, err := newAuthenticatorFromOIDCIssuerURL(config.OIDCIssuerURL, config.OIDCClientID, config.OIDCCAFile, config.OIDCUsernameClaim, config.OIDCGroupsClaim) - if err != nil { - return nil, err - } - authenticators = append(authenticators, oidcAuth) - } - if len(config.ServiceAccountKeyFile) > 0 { serviceAccountAuth, err := newServiceAccountAuthenticator(config.ServiceAccountKeyFile, config.ServiceAccountLookup, config.ServiceAccountTokenGetter) if err != nil { @@ -96,6 +88,20 @@ func New(config AuthenticatorConfig) (authenticator.Request, error) { authenticators = append(authenticators, serviceAccountAuth) } + // NOTE(ericchiang): Keep the OpenID Connect after Service Accounts. + // + // Because both plugins verify JWTs whichever comes first in the union experiences + // cache misses for all requests using the other. While the service account plugin + // simply returns an error, the OpenID Connect plugin may query the provider to + // update the keys, causing performance hits. + if len(config.OIDCIssuerURL) > 0 && len(config.OIDCClientID) > 0 { + oidcAuth, err := newAuthenticatorFromOIDCIssuerURL(config.OIDCIssuerURL, config.OIDCClientID, config.OIDCCAFile, config.OIDCUsernameClaim, config.OIDCGroupsClaim) + if err != nil { + return nil, err + } + authenticators = append(authenticators, oidcAuth) + } + if len(config.KeystoneURL) > 0 { keystoneAuth, err := newAuthenticatorFromKeystoneURL(config.KeystoneURL) if err != nil {