OIDC Flow to the trio: x/oauth2 + go-oidc (mechanical swap) #34

New issue

Closed

opened 2026-09-15 23:27:04 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-15 23:27:04 +00:00

Owner

Parent

#31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio

What to build

The OIDC Flow's protocol code runs on the trio — golang.org/x/oauth2 (authorization URL, authorization-code exchange, refresh grant) and coreos/go-oidc/v3 (id_token validation over a StaticKeySet parsed from the leader-resolved JWKS, ES256). Current behavior is preserved (confidential client, no PKCE yet); the hand-rolled token-endpoint form-POSTs and the internal/jwt verification are removed. Discovery + JWKS stay leader-resolved (no serving-path IdP I/O).

Acceptance criteria

The authorization URL, code exchange, and refresh grant use x/oauth2.
id_token validation uses coreos/go-oidc over a StaticKeySet built from the Snapshot's JWKS (ES256); no serving-path JWKS fetch.
The hand-rolled token-endpoint POSTs and internal/jwt are removed.
Existing OIDC behavior is preserved — the OIDC check/refresh and callback serve tests pass (adapted to the trio).
make lint and make test pass.

Blocked by

None — can start immediately.

## Parent #31 — Spec: public-client support + replace hand-rolled protocol code with the x/oauth2 + go-oidc + hstern trio ## What to build The **OIDC Flow**'s protocol code runs on the trio — `golang.org/x/oauth2` (authorization URL, authorization-code exchange, refresh grant) and `coreos/go-oidc/v3` (id_token validation over a `StaticKeySet` parsed from the leader-resolved JWKS, ES256). **Current behavior is preserved** (confidential client, no PKCE yet); the hand-rolled token-endpoint form-POSTs and the `internal/jwt` verification are removed. Discovery + JWKS stay leader-resolved (no serving-path IdP I/O). ## Acceptance criteria - [ ] The authorization URL, code exchange, and refresh grant use `x/oauth2`. - [ ] id_token validation uses `coreos/go-oidc` over a `StaticKeySet` built from the Snapshot's JWKS (ES256); no serving-path JWKS fetch. - [ ] The hand-rolled token-endpoint POSTs and `internal/jwt` are removed. - [ ] Existing OIDC behavior is preserved — the OIDC check/refresh and callback serve tests pass (adapted to the trio). - [ ] `make lint` and `make test` pass. ## Blocked by - None — can start immediately.

ginjiruu referenced this issue

2026-09-15 23:27:18 +00:00

PKCE (always) + id_token nonce + public-client no-secret #36

ginjiruu referenced this issue

2026-09-15 23:27:28 +00:00

E2E: portable-cluster rip-and-replace re-run (OIDC + Exchange; #30 gateway gate) #37

ginjiruu added the

ready-for-agent

label

2026-09-15 23:27:34 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-16 00:38:30 +00:00