lab/authz-bridge
1
0
Fork 0
Code Issues 9 Pull requests 6 Projects Releases Packages Wiki Activity Actions 12

feat: select the forwarded exchanged token per TokenExchangePolicy #47

Open
ginjiruu wants to merge 0 commits from fix/45-exchange-forward-id-token into master
pull from: fix/45-exchange-forward-id-token
merge into: lab:master
Conversation 0 Commits - Files changed -
ginjiruu commented 2026-09-16 06:09:49 +00:00
Owner
Copy link

New optional spec.forwardTokenType (access_token default, id_token opt-in): the Exchange Flow forwards the selected token as upstream Authorization.

Kanidm's access_token carries no username/groups claims, so the portable apiserver (preferred_username/groups claims) 401s it despite a successful exchange; the id_token shape authenticates. Local selection only (not requested_token_type); hstern stays protocol authority with a raw-body carve-out for the id_token member; missing selection is 503; cache keys on the selection.

Verified live on portable: SAT via gateway 200 with NodeList, 5/5 stable. Live portable-k8s policy flipped to id_token (persisted in flux-clusters).

Fixes #45

New optional spec.forwardTokenType (access_token default, id_token opt-in): the Exchange Flow forwards the selected token as upstream Authorization. Kanidm's access_token carries no username/groups claims, so the portable apiserver (preferred_username/groups claims) 401s it despite a successful exchange; the id_token shape authenticates. Local selection only (not requested_token_type); hstern stays protocol authority with a raw-body carve-out for the id_token member; missing selection is 503; cache keys on the selection. Verified live on portable: SAT via gateway 200 with NodeList, 5/5 stable. Live portable-k8s policy flipped to id_token (persisted in flux-clusters). Fixes #45
feat: select the forwarded exchanged token per TokenExchangePolicy
Some checks failed
Lint / Run on Ubuntu (pull_request) Has been cancelled
Details
E2E Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
5672a18f5f 
New optional spec.forwardTokenType (access_token default, id_token
opt-in): the Exchange Flow forwards the selected token from the
response as upstream Authorization. Kanidm's access_token carries no
username/groups claims, so a Kubernetes apiserver validating those
claims 401s it; the id_token shape authenticates. The selection is
local (not the RFC 8693 requested_token_type, which Kanidm rejects
outside its default); the hstern client stays the protocol authority
with a raw-body carve-out for the id_token member its types drop.
Missing selected token is 503 fail-closed; the token cache keys on
the selection.

Fixes #45
Some checks failed
Lint / Run on Ubuntu (pull_request) Has been cancelled
Details
E2E Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
Tests / Run on Ubuntu (pull_request) Has been cancelled
Details
This branch is already included in the target branch. There is nothing to merge.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/45-exchange-forward-id-token:fix/45-exchange-forward-id-token
git switch fix/45-exchange-forward-id-token

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff fix/45-exchange-forward-id-token
git switch fix/45-exchange-forward-id-token
git rebase master
git switch master
git merge --ff-only fix/45-exchange-forward-id-token
git switch fix/45-exchange-forward-id-token
git rebase master
git switch master
git merge --no-ff fix/45-exchange-forward-id-token
git switch master
git merge --squash fix/45-exchange-forward-id-token
git switch master
git merge --ff-only fix/45-exchange-forward-id-token
git switch master
git merge fix/45-exchange-forward-id-token
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info

   
needs-triage

   
ready-for-agent

   
ready-for-human

   
wontfix
No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/authz-bridge!47
No description provided.