[Intro] Yeah... cold bass, hear me now Dark room, di clock a tick, tick, tick [Verse 1] Somebody change dem profile email, grab di address like it's theirs Tenant admin or user, nuh need no proof, just a field and dem a steer Token come in, app say "Ah, dat one yuh know" Lookup by di email, straight to di privileged account, oh no Di unsafe step is di lookup, mi tell yuh sure as dawn Attacker supply di victim address, app supply di permissions gone [Chorus] VERIFIED OR NUH DEAL! (Verified or nuh deal!) email_verified must be Boolean true, nuh string, nuh maybe, nuh feel Claim absent? Reject! Claim false? Reject! (Reject!) Fail closed, fail closed, lock di gate tight! Issuer and sub, dat's di key, not di email name Trusted issuer nuh mean trusted to claim anybody's game! [Verse 2] Kubernetes say normal users live outside di cluster, no user objects deh Authentication hand over username and groups, den authorisation read dem next If di username match a binding already, yuh lose before di check start So review di identity construction first, den touch di permissions, heart Don't coerce a string into a Boolean, don't read a missing claim as yes Keep di condition pon di lookup itself, every single time, yes! [Bridge] Authentication is who yuh are. Authorisation is what yuh can do. Keep dem apart. Approve each issuer. Approve each tenant too. Verified email is a prerequisite, not a replacement for di issuer scope So don't let an address decide whose account yuh walk in with hope [Chorus] VERIFIED OR NUH DEAL! (Verified or nuh deal!) email_verified must be Boolean true, nuh string, nuh maybe, nuh feel Claim absent? Reject! Claim false? Reject! (Reject!) Fail closed, fail closed, lock di gate tight! Issuer and sub, dat's di key, not di email name Trusted issuer nuh mean trusted to claim anybody's game! [Outro] Verified or nuh deal... (nuh deal) Verified or nuh deal... (come again, nuh deal) Ha!
