AWS IAM medium security documentation change
Summary
Added documentation clarifying that when OIDC identity provider's discovery and JWKS endpoints use different hosts, thumbprints for both endpoints must be included in the OIDC provider configuration.
Security assessment
This change addresses a potential security misconfiguration scenario where OIDC providers using different hosts for discovery and JWKS endpoints could cause authentication failures if both thumbprints aren't configured. This is directly related to security as it prevents authentication failures and ensures proper certificate validation for OIDC providers with distributed endpoints.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.md b/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.md index 9cb639fea..2303e59ec 100644 --- a//IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.md +++ b//IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.md @@ -33,0 +34,6 @@ AWS secures communication with OIDC identity providers (IdPs) using our library +###### Important + +If your OIDC identity provider uses different hosts for the discovery endpoint (the issuer URL) and the JWKS endpoint (`jwks_uri`), you must include the thumbprint for both endpoints in your OIDC provider's thumbprint list. AWS validates the thumbprint of both endpoints when falling back to thumbprint verification. If either thumbprint is missing from the configured list, authentication fails. + +Most OIDC providers host both endpoints on the same domain, so a single thumbprint covers both. You only need to add a separate thumbprint if your provider uses different hosts or certificates for the two endpoints. + @@ -60,0 +67,4 @@ Open this URL in a web browser, replacing `server.example.com` with your IdP ser +###### Note + +If your discovery and JWKS endpoints use different hosts, note the fully qualified domain name from your issuer URL (the URL you used in Step 2, without the `/.well-known/openid-configuration` path). If this domain differs from the `jwks_uri` domain you copied in this step, perform Step 4 through Step 6 for both domains and include both thumbprints when creating your OIDC provider. + @@ -101,0 +112,4 @@ Remove the colon characters (:) from this string to produce the final thumbprint +###### Note + +If your discovery endpoint uses a different host than your JWKS endpoint, repeat Step 4 through Step 6 using the discovery endpoint domain (your issuer URL domain). Include both thumbprints when creating or updating your OIDC identity provider using [CreateOpenIDConnectProvider](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html) or [UpdateOpenIDConnectProviderThumbprint](https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateOpenIDConnectProviderThumbprint.html). +