Fix #10: accept OIDC JWTs on /v1/* via inbound chain#11
Merged
Conversation
The inbound chain previously held only api-key + static-bearer authenticators, so an Authorization: Bearer <jwt> hitting /v1/* was rejected with 401 even when oidc.enabled was true and the JWT carried the right issuer/audience — the OIDC validator was wired only into the portal session flow. Adds an OIDCBearerAuthenticator adapter that returns ErrNoCredential on non-JWT bearers (so static dev tokens still fall through) and ErrInvalidCredential only on JWTs that fail verification; the server now builds one OIDC validator at startup and shares it between the chain and BrowserAuth. Fixes #10.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OIDCBearerAuthenticatorinpkg/auth/inboundthat wrapsauth.OIDCAuthenticatorwith chain-safe semantics (ErrNoCredentialfor missing or non-JWT bearers,ErrInvalidCredentialonly when a structurally-valid JWT fails verification).apikey → oidc → bearer, soAuthorization: Bearer <jwt>from the configured IdP authenticates on/v1/*.buildPortalso the chain andBrowserAuthshare one instance — discovery + JWKS fetch run once at startup.Fixes #10.
Test plan
make verifypasses locally (gofmt, tidy, build, golangci-lint, gosec, codeql, govulncheck, UI typecheck + build, embedded-SPA sync gate, full Go tests).TestChain_OIDCBeforeBearercovers the four cases from the ticket:Identityfrom OIDC.ErrInvalidCredential, no fallthrough to static bearer.IdentityfromBearerAuthenticator(OIDC returnsErrNoCredentialon non-JWT).allow_anonymous=false→ErrNoCredential.looksLikeJWTedges and the nil-validator guard.curl -H "Authorization: Bearer <jwt>" /v1/whoamireturns 200 withsubjectfrom the JWTsubclaim.Notes
The ticket's optional proposal #3 (softening
BearerAuthenticatorto returnErrNoCredentialon non-match) was intentionally skipped — it would change behavior for non-OIDC deployments and is not needed here. The OIDC adapter returningErrNoCredentialon non-JWT bearers is enough to preserve the static-dev-token fallthrough.