Skip to content

DOC-377: Add OIDC identity source support for Verified Permissions #848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HarshCasper wants to merge 1 commit into
base: main
Choose a base branch
from
+22 −3
Open

DOC-377: Add OIDC identity source support for Verified Permissions #848

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/content/docs/aws/customization/configuration-options.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,6 +367,12 @@ Please consult the [migration guide](/aws/services/lambda#migrating-to-lambda-v2
| - | - | - |
| `SFN_MOCK_CONFIG` | `/tmp/MockConfigFile.json` | Specifies the file path to the mock configuration file that defines mock service integrations for Step Functions. |

### Verified Permissions

| Variable | Example Values | Description |
| - | - | - |
| `VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION` | `0` (default) \| `1` | Disables JWT signature verification for OIDC identity sources. When enabled, LocalStack will decode tokens without validating signatures against the issuer's JWKS, allowing use of unreachable or self-signed OIDC providers in local development. |

## Security

:::danger
Expand Down
19 changes: 16 additions & 3 deletions src/content/docs/aws/services/verifiedpermissions.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ Amazon Verified Permissions is a scalable service for managing fine-grained perm
It helps secure applications by moving authorization logic outside the app and managing policies in one place, using the [Cedar policy language](https://docs.cedarpolicy.com/) to define access rules.
It checks if a principal can take an action on a resource in a specific context in your application.

LocalStack allows you to use the Verified Permissions APIs in your local environment to test your authorization logic, with integrations with other AWS services like Cognito. LocalStack uses the Cedar engine to evaluate permissions, ensuring authorization testing closely matches AWS Verified Permissions behavior.
LocalStack allows you to use the Verified Permissions APIs in your local environment to test your authorization logic, with integrations with other AWS services like Cognito and support for custom OIDC identity providers. LocalStack uses the Cedar engine to evaluate permissions, ensuring authorization testing closely matches AWS Verified Permissions behavior.
The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of Verified Permissions' integration with LocalStack.

## Getting started
Expand Down Expand Up @@ -128,11 +128,24 @@ You should get the following output, indicating that your request was allowed:
}
```

## Identity Sources

LocalStack supports both Cognito User Pools and custom OIDC (OpenID Connect) identity providers as identity sources for Verified Permissions.

When you create an identity source with an [`OpenIdConnectConfiguration`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html), LocalStack:
- Fetches the OIDC discovery document and JWKS (JSON Web Key Set) from the configured issuer
- Validates JWT signatures against the issuer's public keys
- Enforces token expiration (`exp` claim)
- Extracts principal information and group memberships from token claims
- Evaluates authorization requests using [`IsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) and [`BatchIsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.html)

@bentsku bentsku Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note: I think from the sentence above, this is a consequence of "when you create an identity source", but I don't think this is true. By creating an identity source, you can then call IsAuthorizedWithToken, so it's the result, it shouldn't be a bullet point. Does it make sense?


:::note
For local development scenarios where the OIDC issuer may not be reachable or uses a self-signed certificate, you can disable JWT signature verification by setting the `VERIFIEDPERMISSIONS_DISABLE_JWT_VERIFICATION=1` environment variable. See the [Configuration reference](/aws/customization/configuration-options/#verified-permissions) for details.
:::

## Current limitations

- No Schema validation when creating a new schema using `PutSchema`, and no Policy validation using said schema when creating policies and template policies.
- Only Cognito is supported as an `IdentitySource`, external OIDC providers are not yet implemented.
- The validation around Identity Sources and JWT is not fully yet implemented: the identity source is not validated to have a valid `jwks.json` endpoint, and the issuer, signature and expiration of the incoming JWT are not validated.

## API Coverage

Expand Down
Loading