Exchange Check #15

New issue

Closed

opened 2026-09-14 17:04:57 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:57 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The Exchange Flow Check (machine tokens): a service account presents its Kanidm API token, and the Bridge exchanges it for OAuth2 tokens via the RFC 8693 grant (no client secret; the App's own clientID is the audience; the policy's scopes), then hands the exchanged token to the backend. From the service account's perspective: present the API token, get authorized to the backend as the App.

Acceptance criteria

Reads the presented Service Account Token from the configured header/prefix/tokenType (default Authorization / Bearer / access_token).
A missing/malformed subject token is denied with 401.
Performs the RFC 8693 grant with no client secret, audience = the App's own clientID, the policy's scopes (asserted on the token-endpoint double's received form).
Injects the exchanged access_token as Authorization: Bearer <token> and headers_to_removes the incoming Authorization (the subject token is consumed, not forwarded).
An RFC 8693 rejection by the IdP, or an unreachable token endpoint, is served as 5xx (fail-closed).

Blocked by

#12 — Build surface + flow-serving server scaffolding

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The Exchange Flow `Check` (machine tokens): a service account presents its Kanidm API token, and the Bridge exchanges it for OAuth2 tokens via the RFC 8693 grant (no client secret; the App's own clientID is the `audience`; the policy's scopes), then hands the exchanged token to the backend. From the service account's perspective: present the API token, get authorized to the backend as the App. ## Acceptance criteria - [ ] Reads the presented Service Account Token from the configured header/prefix/tokenType (default `Authorization` / `Bearer ` / `access_token`). - [ ] A missing/malformed subject token is denied with `401`. - [ ] Performs the RFC 8693 grant with **no client secret**, `audience` = the App's own clientID, the policy's scopes (asserted on the token-endpoint double's received form). - [ ] Injects the exchanged `access_token` as `Authorization: Bearer <token>` and `headers_to_remove`s the incoming `Authorization` (the subject token is consumed, not forwarded). - [ ] An RFC 8693 rejection by the IdP, or an unreachable token endpoint, is served as `5xx` (fail-closed). ## Blocked by - #12 — Build surface + flow-serving server scaffolding

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:33 +00:00

~~ginjiruu referenced this issue 2026-09-14 17:05:34 +00:00~~

OIDC lazy refresh #17

ginjiruu referenced this issue

2026-09-14 17:05:35 +00:00

Exchange per-replica token cache #18

~~ginjiruu referenced this issue 2026-09-14 17:05:36 +00:00~~

Services (static) + ReferenceGrant (controller-managed) #20

ginjiruu added the

ready-for-agent

label