docs: spec and implementation plan for JWKS multi-issuer authentication - #1097
Open
pditommaso wants to merge 3 commits into
Open
docs: spec and implementation plan for JWKS multi-issuer authentication#1097pditommaso wants to merge 3 commits into
pditommaso wants to merge 3 commits into
Conversation
Design for replacing the delegation-only validation of Platform JWT tokens with canonical JWKS verification, supporting multiple Platform issuers dynamically (pairing acts as issuer registration) and issuers behind private networks (JWKS fetched over the pairing websocket channel). The reusable core is planned as a new libseqera module lib-auth-jwks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…OIDC module Spec/plan revision after verifying that (a) Platform's platform-oidc module already serves /.well-known/jwks.json with RS256 keys and iss = API endpoint when TOWER_OIDC_PEM_PATH is set, and (b) micronaut-security-jwt exposes the JwksClient/JwkSetFetcher/JwkValidator extension points. lib-auth-jwks now adds only dynamic multi-issuer resolution on top of Micronaut's machinery; the custom fetcher/cache-store/HTTP classes are dropped and Wave plugs the pairing tunnel in via a JwksClient bean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Design documents only — no code changes. Spec + implementation plan for replacing Wave's delegation-only validation of Platform JWT tokens with canonical JWKS verification:
PairingRecordis a candidate issuer; the token'sissclaim must match the paired endpoint.TowerConnector/pairing websocket tunnel (ProxyHttpRequest), so no changes to lib-pairing are needed./user-infodelegation path indefinitely.lib-auth-jwks) only adds dynamic per-issuer JWKS resolution; retrieval, caching and signature verification reusemicronaut-security-jwt'sJwksClient/JwkSetFetcher/JwkValidatorextension points. Wave contributes aJwksClientbean routing over the pairing tunnel and a flag-gated wiring inUserServiceImpl(wave.auth.jwks.enabled, default off).Platform prerequisites (mostly already shipped)
The
platform-oidcmodule already provides, whenTOWER_OIDC_PEM_PATHis configured: the/.well-known/jwks.jsonendpoint (RS256, RFC 7638kid),iss= Platform API endpoint URL, and inbound acceptance of RS256 tokens. Remaining Platform work (tracked separately):TOWER_OIDC_PEM_PATHconfigured in deployments that enable thisFiles
docs/superpowers/specs/2026-07-22-jwks-multi-issuer-auth-design.mddocs/superpowers/plans/2026-07-22-jwks-multi-issuer-auth.md🤖 Generated with Claude Code