Thanks to @Stype:

Update the kmsauth token validation code to verify that all remote_usernames are checked against the offered kmsauth_token.
lyft · Mar 29, 2017 · c543416 · c543416
1 parent 7c025fb
commit c543416
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/bless/aws_lambda/bless_lambda.py b/bless/aws_lambda/bless_lambda.py
@@ -138,7 +138,7 @@ def lambda_handler(event, context=None, ca_private_key_password=None,
                 )
                 # decrypt_token will raise a TokenValidationError if token doesn't match
                 validator.decrypt_token(
-                    "2/user/{}".format(request.remote_usernames.split(',')[0]),
+                    "2/user/{}".format(request.remote_usernames),
                     request.kmsauth_token
                 )
             except TokenValidationError as e: