lab/authz-bridge
1
0
Fork 0
Code Issues 9 Pull requests 6 Projects Releases Packages Wiki Activity Actions 12

fix: OIDC bearer tokens for kubectl/kubelogin #46

Open
ginjiruu wants to merge 0 commits from fix/44-oidc-bearer-tokens into master
pull from: fix/44-oidc-bearer-tokens
merge into: lab:master
Conversation 0 Commits - Files changed -
ginjiruu commented 2026-09-16 05:52:40 +00:00
Owner
Copy link

Bearer-first path on the OIDC Check so token-presenting clients (kubectl/kubelogin) work on the same host/path as the browser session flow.

  • Valid bearer (Snapshot JWKS, iss/aud/exp ES256) -> OK, forwarded as-is for the apiserver to authorize.
  • Presented-but-invalid bearer -> 401 (kubectl cannot use a 302).
  • No Authorization header -> unchanged cookie/302 path.
  • ADR-0011 records the 401 rule.

Verified live on portable: kubectl get nodes OK, garbage bearer 401, no-auth 302.

Fixes #44

Bearer-first path on the OIDC Check so token-presenting clients (kubectl/kubelogin) work on the same host/path as the browser session flow. - Valid bearer (Snapshot JWKS, iss/aud/exp ES256) -> OK, forwarded as-is for the apiserver to authorize. - Presented-but-invalid bearer -> 401 (kubectl cannot use a 302). - No Authorization header -> unchanged cookie/302 path. - ADR-0011 records the 401 rule. Verified live on portable: kubectl get nodes OK, garbage bearer 401, no-auth 302. Fixes #44
fix: accept presented bearer tokens on the OIDC Check path
Some checks failed
Lint / Run on Ubuntu (pull_request) Has been cancelled
Details
E2E Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
b66b52be52 
Bearer-first before the session-cookie check: a presented Authorization
bearer (kubectl/kubelogin, no cookie) is validated against the Snapshot's
JWKS (iss/aud/exp, ES256) and forwarded as-is for the upstream apiserver
to authorize. A presented-but-invalid bearer is 401 (a machine client
cannot use a 302); no Authorization header keeps the cookie/302 path.

Refs #44
Some checks failed
Lint / Run on Ubuntu (pull_request) Has been cancelled
Details
E2E Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
This branch is already included in the target branch. There is nothing to merge.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/44-oidc-bearer-tokens:fix/44-oidc-bearer-tokens
git switch fix/44-oidc-bearer-tokens

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff fix/44-oidc-bearer-tokens
git switch fix/44-oidc-bearer-tokens
git rebase master
git switch master
git merge --ff-only fix/44-oidc-bearer-tokens
git switch fix/44-oidc-bearer-tokens
git rebase master
git switch master
git merge --no-ff fix/44-oidc-bearer-tokens
git switch master
git merge --squash fix/44-oidc-bearer-tokens
git switch master
git merge --ff-only fix/44-oidc-bearer-tokens
git switch master
git merge fix/44-oidc-bearer-tokens
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info

   
needs-triage

   
ready-for-agent

   
ready-for-human

   
wontfix
No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/authz-bridge!46
No description provided.