Skip to content

docs(auth): do not set AUTH_SIGNING_PUBKEY on a Fleet behind password-mode Auth #1513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jzhao234 merged 1 commit into from
Sep 15, 2026
+12 −5
Merged

docs(auth): do not set AUTH_SIGNING_PUBKEY on a Fleet behind password-mode Auth #1513

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions docs/features/central-auth-integration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,20 @@ FLEET_OIDC_ISSUER=https://auth.example.com
FLEET_OIDC_CLIENT_ID=fleet-client-id
FLEET_OIDC_CLIENT_SECRET=<one-time secret from auth app create>
FLEET_OIDC_SCOPES=openid email
AUTH_SIGNING_PUBKEY=<Auth Ed25519 public key>
```

Fleet also reads Auth's published `/jwks.json` (cached ten minutes, refreshed
once when a logout token names an unknown `kid`), so an Auth signing-key
rotation needs no Fleet env edit. Keep one static key as bootstrap and
offline fallback.
Do **not** set `AUTH_SIGNING_PUBKEY` on a Fleet that signs in through a
password-mode Auth. That variable is the switch for the legacy magic-link
path above: the login page shows "Use Elcano email" whenever it is set, and
a password-mode Auth never mints the shared `elcano_auth` cookie, so that
button dead-ends. Fleet verifies Auth's signed back-channel logout tokens
from Auth's published `/jwks.json` (cached ten minutes, refreshed once when a
logout token names an unknown `kid`), so a signing-key rotation needs no
Fleet env edit and no static key is required. The trade-off is that Fleet
must be able to reach the Auth host when a logout arrives; Auth retries
failed deliveries for seven days. Set `AUTH_SIGNING_PUBKEY` only where the
legacy magic-link cookie is actually in use; it then also serves as an
offline fallback for logout verification.

Register the exact callback and signed logout endpoint on Auth:

Expand Down