OIDC steady-state Check #14

New issue

Closed

opened 2026-09-14 17:04:56 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:56 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The OIDC steady-state Check: given a Session cookie holding an id_token, the Check validates it against the Snapshot's JWKS and, if valid, forwards the identity; if there is no (valid) Session, it sends the browser to the IdP to sign in. From the user's perspective: a signed-in user's request is authorized and their identity is forwarded to the backend; a not-signed-in user is redirected to Kanidm.

Acceptance criteria

A valid Session cookie (an id_token signed with the Snapshot's JWKS key) is validated (signature + exp/iss/aud) and the OidcInjection claims are injected as headers; the Check returns OK.
No Session, or an invalid/expired/mis-signed id_token, is treated as no Session: a 302 to the authorization endpoint via denied_response (status=302 + Location + the state/nonce cookie via Set-Cookie).
A request whose Host matches no App is denied with 403; an App with secretReady=false is served as 5xx.
Verified via the flow-serving server seam (Seam A): a go-jose-generated ES256 key in the Snapshot's JWKS + a signed fixture id_token.

Blocked by

#12 — Build surface + flow-serving server scaffolding

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The OIDC steady-state `Check`: given a Session cookie holding an `id_token`, the `Check` validates it against the Snapshot's JWKS and, if valid, forwards the identity; if there is no (valid) Session, it sends the browser to the IdP to sign in. From the user's perspective: a signed-in user's request is authorized and their identity is forwarded to the backend; a not-signed-in user is redirected to Kanidm. ## Acceptance criteria - [ ] A valid Session cookie (an `id_token` signed with the Snapshot's JWKS key) is validated (signature + `exp`/`iss`/`aud`) and the `OidcInjection` claims are injected as headers; the `Check` returns `OK`. - [ ] No Session, or an invalid/expired/mis-signed `id_token`, is treated as no Session: a `302` to the authorization endpoint via `denied_response` (`status=302` + `Location` + the `state`/nonce cookie via `Set-Cookie`). - [ ] A request whose Host matches no App is denied with `403`; an App with `secretReady=false` is served as `5xx`. - [ ] Verified via the flow-serving server seam (Seam A): a go-jose-generated ES256 key in the Snapshot's `JWKS` + a signed fixture `id_token`. ## Blocked by - #12 — Build surface + flow-serving server scaffolding

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:33 +00:00

~~ginjiruu referenced this issue 2026-09-14 17:05:36 +00:00~~

Services (static) + ReferenceGrant (controller-managed) #20

ginjiruu referenced this issue

2026-09-14 17:06:35 +00:00

OIDC callback (first sign-in) #16

ginjiruu referenced this issue

2026-09-14 17:06:36 +00:00

OIDC lazy refresh #17

ginjiruu referenced this issue

2026-09-14 17:06:37 +00:00