From d246d9d64777ca4ed33de99ec8a7e21106ea08b5 Mon Sep 17 00:00:00 2001 From: LocalStack Bot Date: Wed, 5 Aug 2026 15:00:04 +0000 Subject: [PATCH] DOC-377: automated docs update --- .../customization/configuration-options.md | 6 ++++++ .../docs/aws/services/verifiedpermissions.mdx | 19 ++++++++++++++++--- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/src/content/docs/aws/customization/configuration-options.md b/src/content/docs/aws/customization/configuration-options.md index bf641a97..91eda53f 100644 --- a/src/content/docs/aws/customization/configuration-options.md +++ b/src/content/docs/aws/customization/configuration-options.md @@ -367,6 +367,12 @@ Please consult the [migration guide](/aws/services/lambda#migrating-to-lambda-v2 | - | - | - | | `SFN_MOCK_CONFIG` | `/tmp/MockConfigFile.json` | Specifies the file path to the mock configuration file that defines mock service integrations for Step Functions. | +### Verified Permissions + +| Variable | Example Values | Description | +| - | - | - | +| `VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION` | `0` (default) \| `1` | Disables JWT signature verification for OIDC identity sources. When enabled, LocalStack will decode tokens without validating signatures against the issuer's JWKS, allowing use of unreachable or self-signed OIDC providers in local development. | + ## Security :::danger diff --git a/src/content/docs/aws/services/verifiedpermissions.mdx b/src/content/docs/aws/services/verifiedpermissions.mdx index bca27101..e38a6fc5 100644 --- a/src/content/docs/aws/services/verifiedpermissions.mdx +++ b/src/content/docs/aws/services/verifiedpermissions.mdx @@ -12,7 +12,7 @@ Amazon Verified Permissions is a scalable service for managing fine-grained perm It helps secure applications by moving authorization logic outside the app and managing policies in one place, using the [Cedar policy language](https://docs.cedarpolicy.com/) to define access rules. It checks if a principal can take an action on a resource in a specific context in your application. -LocalStack allows you to use the Verified Permissions APIs in your local environment to test your authorization logic, with integrations with other AWS services like Cognito. LocalStack uses the Cedar engine to evaluate permissions, ensuring authorization testing closely matches AWS Verified Permissions behavior. +LocalStack allows you to use the Verified Permissions APIs in your local environment to test your authorization logic, with integrations with other AWS services like Cognito and support for custom OIDC identity providers. LocalStack uses the Cedar engine to evaluate permissions, ensuring authorization testing closely matches AWS Verified Permissions behavior. The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of Verified Permissions' integration with LocalStack. ## Getting started @@ -128,11 +128,24 @@ You should get the following output, indicating that your request was allowed: } ``` +## Identity Sources + +LocalStack supports both Cognito User Pools and custom OIDC (OpenID Connect) identity providers as identity sources for Verified Permissions. + +When you create an identity source with an [`OpenIdConnectConfiguration`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html), LocalStack: +- Fetches the OIDC discovery document and JWKS (JSON Web Key Set) from the configured issuer +- Validates JWT signatures against the issuer's public keys +- Enforces token expiration (`exp` claim) +- Extracts principal information and group memberships from token claims +- Evaluates authorization requests using [`IsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) and [`BatchIsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.html) + +:::note +For local development scenarios where the OIDC issuer may not be reachable or uses a self-signed certificate, you can disable JWT signature verification by setting the `VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION=1` environment variable. See the [Configuration reference](/aws/customization/configuration-options/#verified-permissions) for details. +::: + ## Current limitations - No Schema validation when creating a new schema using `PutSchema`, and no Policy validation using said schema when creating policies and template policies. -- Only Cognito is supported as an `IdentitySource`, external OIDC providers are not yet implemented. -- The validation around Identity Sources and JWT is not fully yet implemented: the identity source is not validated to have a valid `jwks.json` endpoint, and the issuer, signature and expiration of the incoming JWT are not validated. ## API Coverage