diff --git a/calm-hub-ui/src/ProtectedRoute.test.tsx b/calm-hub-ui/src/ProtectedRoute.test.tsx
new file mode 100644
index 000000000..07d2fcc0e
--- /dev/null
+++ b/calm-hub-ui/src/ProtectedRoute.test.tsx
@@ -0,0 +1,182 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('./authService.js', () => ({
+    authService: {
+        getUser: vi.fn(),
+        login: vi.fn(),
+        processRedirect: vi.fn(),
+    },
+}));
+
+
+import ProtectedRoute from './ProtectedRoute.js';
+import { authService } from './authService.js';
+
+const PRE_AUTH_HASH_KEY = 'calm_pre_auth_hash';
+
+const fakeUser = {
+    expired: false,
+    id_token: 'test-id-token',
+    access_token: 'test-access-token',
+    profile: { preferred_username: 'testuser' },
+} as unknown as import('oidc-client-ts').User;
+
+describe('ProtectedRoute', () => {
+    let replaceStateSpy: ReturnType<typeof vi.spyOn>;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        sessionStorage.clear();
+        replaceStateSpy = vi.spyOn(window.history, 'replaceState');
+    });
+
+    afterEach(() => {
+        replaceStateSpy.mockRestore();
+        Object.defineProperty(window, 'location', {
+            value: window.location,
+            writable: true,
+        });
+    });
+
+    describe('hash preservation before OIDC redirect', () => {
+        it('saves window.location.hash to sessionStorage before calling login', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.login).mockResolvedValue(undefined);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, hash: '#/fae-calm/architectures/123/abc', search: '' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(authService.login).toHaveBeenCalled();
+            });
+            expect(sessionStorage.getItem(PRE_AUTH_HASH_KEY)).toBe('#/fae-calm/architectures/123/abc');
+        });
+
+        it('does not save an empty hash to sessionStorage', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.login).mockResolvedValue(undefined);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, hash: '', search: '' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(authService.login).toHaveBeenCalled();
+            });
+            expect(sessionStorage.getItem(PRE_AUTH_HASH_KEY)).toBeNull();
+        });
+    });
+
+    describe('hash restoration after OIDC callback', () => {
+        it('restores the saved hash after processing the redirect callback', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            sessionStorage.setItem(PRE_AUTH_HASH_KEY, '#/fae-calm/architectures/123/abc');
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(replaceStateSpy).toHaveBeenCalledWith(
+                    null,
+                    '',
+                    '/#/fae-calm/architectures/123/abc'
+                );
+            });
+            expect(sessionStorage.getItem(PRE_AUTH_HASH_KEY)).toBeNull();
+        });
+
+        it('falls back to #/ when no hash was saved', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(replaceStateSpy).toHaveBeenCalledWith(null, '', '/#/');
+            });
+        });
+
+        it('falls back to #/ when saved hash is just #', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            sessionStorage.setItem(PRE_AUTH_HASH_KEY, '#');
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(replaceStateSpy).toHaveBeenCalledWith(null, '', '/#/');
+            });
+        });
+
+        it('renders children after successful redirect processing', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            expect(await screen.findByText('Protected Content')).toBeInTheDocument();
+        });
+    });
+
+    describe('already authenticated user', () => {
+        it('renders children immediately without redirect when session exists', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(fakeUser);
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            expect(await screen.findByText('Protected Content')).toBeInTheDocument();
+            expect(authService.login).not.toHaveBeenCalled();
+            expect(authService.processRedirect).not.toHaveBeenCalled();
+        });
+    });
+});
diff --git a/calm-hub-ui/src/ProtectedRoute.tsx b/calm-hub-ui/src/ProtectedRoute.tsx
index 64ff61be7..035f26032 100644
--- a/calm-hub-ui/src/ProtectedRoute.tsx
+++ b/calm-hub-ui/src/ProtectedRoute.tsx
@@ -6,6 +6,8 @@ interface ProtectedRouteProps {
     children: ReactNode;
 }
 
+const PRE_AUTH_HASH_KEY = 'calm_pre_auth_hash';
+
 const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     const [user, setUser] = useState<User | null>(null);
     const [loading, setLoading] = useState(true);
@@ -17,8 +19,18 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
                 setUser(currentUser);
             } else if (window.location.search.includes('code=')) {
                 const loggedInUser = await authService.processRedirect();
+                const savedHash = sessionStorage.getItem(PRE_AUTH_HASH_KEY);
+                sessionStorage.removeItem(PRE_AUTH_HASH_KEY);
+                if (savedHash && savedHash !== '#' && savedHash !== '#/') {
+                    window.history.replaceState(null, '', window.location.pathname + savedHash);
+                } else {
+                    window.history.replaceState(null, '', window.location.pathname + '#/');
+                }
                 setUser(loggedInUser);
             } else {
+                if (window.location.hash) {
+                    sessionStorage.setItem(PRE_AUTH_HASH_KEY, window.location.hash);
+                }
                 await authService.login();
             }
             setLoading(false);
@@ -34,6 +46,7 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     if (!user) {
         return <div>Redirecting to login...</div>;
     }
+
     return <>{children}</>;
 };
 export default ProtectedRoute;
diff --git a/calm-hub-ui/src/authConfig.test.ts b/calm-hub-ui/src/authConfig.test.ts
new file mode 100644
index 000000000..729d151d8
--- /dev/null
+++ b/calm-hub-ui/src/authConfig.test.ts
@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import axios from 'axios';
+import { getAuthConfig, isOidcEnabled, isGitHubMode } from './authConfig.js';
+
+vi.mock('axios');
+
+describe('authConfig', () => {
+    beforeEach(() => {
+        vi.resetModules();
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    describe('fetchAuthConfig', () => {
+        it('should fetch config from backend', async () => {
+            const mockConfig = {
+                oidc: { enabled: true, provider: 'entra-id', authority: 'https://login.microsoft.com/tenant', clientId: 'client-123', scopes: ['openid', 'profile'] },
+                databaseMode: 'github',
+            };
+            vi.mocked(axios.get).mockResolvedValue({ data: mockConfig });
+
+            const { fetchAuthConfig: fetch } = await import('./authConfig.js');
+            const result = await fetch();
+
+            expect(result.oidc.enabled).toBe(true);
+            expect(result.oidc.provider).toBe('entra-id');
+            expect(result.databaseMode).toBe('github');
+        });
+
+        it('should retry once and succeed on transient failure', async () => {
+            const mockConfig = {
+                oidc: { enabled: true, provider: 'generic-oidc' },
+                databaseMode: 'mongo',
+            };
+            vi.mocked(axios.get)
+                .mockRejectedValueOnce(new Error('Network error'))
+                .mockResolvedValueOnce({ data: mockConfig });
+
+            const { fetchAuthConfig: fetch } = await import('./authConfig.js');
+            const result = await fetch();
+
+            expect(result.oidc.enabled).toBe(true);
+        });
+
+        it('should throw when both attempts fail', async () => {
+            vi.mocked(axios.get).mockRejectedValue(new Error('Network error'));
+
+            const { fetchAuthConfig: fetch } = await import('./authConfig.js');
+
+            await expect(fetch()).rejects.toThrow('Unable to load authentication configuration');
+        });
+    });
+
+    describe('getAuthConfig', () => {
+        it('should return default config before fetch', () => {
+            const config = getAuthConfig();
+            expect(config.oidc.enabled).toBe(false);
+        });
+    });
+
+    describe('isOidcEnabled', () => {
+        it('should return false when not fetched', () => {
+            expect(isOidcEnabled()).toBe(false);
+        });
+    });
+
+    describe('isGitHubMode', () => {
+        it('should return false when not fetched', () => {
+            expect(isGitHubMode()).toBe(false);
+        });
+    });
+});
diff --git a/calm-hub-ui/src/authConfig.ts b/calm-hub-ui/src/authConfig.ts
new file mode 100644
index 000000000..c7b20d24c
--- /dev/null
+++ b/calm-hub-ui/src/authConfig.ts
@@ -0,0 +1,56 @@
+import axios from 'axios';
+
+export interface AuthConfig {
+    oidc: {
+        enabled: boolean;
+        provider?: string;
+        authority?: string;
+        clientId?: string;
+        scopes?: string[];
+        redirectUri?: string;
+    };
+    databaseMode: string;
+}
+
+const DEFAULT_CONFIG: AuthConfig = {
+    oidc: { enabled: false },
+    databaseMode: 'mongo',
+};
+
+let cachedConfig: AuthConfig | null = null;
+
+export async function fetchAuthConfig(): Promise<AuthConfig> {
+    if (cachedConfig) {
+        return cachedConfig;
+    }
+    const attempt = async (): Promise<AuthConfig> => {
+        const response = await axios.get<AuthConfig>('/api/calm/auth/config');
+        return response.data;
+    };
+    try {
+        cachedConfig = await attempt();
+        return cachedConfig;
+    } catch {
+        // Retry once after a short delay before giving up
+        try {
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+            cachedConfig = await attempt();
+            return cachedConfig;
+        } catch (retryError) {
+            console.error('Failed to fetch auth config after retry:', retryError);
+            throw new Error('Unable to load authentication configuration');
+        }
+    }
+}
+
+export function getAuthConfig(): AuthConfig {
+    return cachedConfig || DEFAULT_CONFIG;
+}
+
+export function isOidcEnabled(): boolean {
+    return cachedConfig?.oidc?.enabled ?? false;
+}
+
+export function isGitHubMode(): boolean {
+    return cachedConfig?.databaseMode === 'github';
+}
diff --git a/calm-hub-ui/src/authService.test.tsx b/calm-hub-ui/src/authService.test.tsx
index e9fe517ad..f7994494d 100644
--- a/calm-hub-ui/src/authService.test.tsx
+++ b/calm-hub-ui/src/authService.test.tsx
@@ -6,6 +6,7 @@ import {
     getAuthHeaders,
     isAuthServiceEnabled,
 } from './authService.js';
+import * as authConfig from './authConfig.js';
 
 vi.mock('axios');
 
@@ -16,6 +17,10 @@ describe('authService', () => {
 
     describe('checkAuthorityService', () => {
         it('should return true when the authority service responds successfully', async () => {
+            vi.spyOn(authConfig, 'getAuthConfig').mockReturnValue({
+                oidc: { enabled: true, authority: 'https://auth.example.com' },
+                databaseMode: 'mongo',
+            });
             vi.mocked(axios.head).mockResolvedValue({ status: 200 });
             const result = await checkAuthorityService();
             expect(result).toBe(true);
diff --git a/calm-hub-ui/src/authService.tsx b/calm-hub-ui/src/authService.tsx
index 8e5457777..517edc8e3 100644
--- a/calm-hub-ui/src/authService.tsx
+++ b/calm-hub-ui/src/authService.tsx
@@ -1,35 +1,40 @@
-import { UserManager, Log, User } from 'oidc-client-ts';
+import { UserManager, User } from 'oidc-client-ts';
 import axios from 'axios';
+import { fetchAuthConfig, getAuthConfig } from './authConfig.js';
 
-const config = {
-    authority: 'https://calm-hub.finos.org:9443/realms/calm-hub-realm',
-    client_id: 'calm-hub-authz-code',
-    redirect_uri: window.location.origin,
-    response_type: 'code',
-    scope: 'openid profile architectures:read adrs:all',
-    post_logout_redirect_uri: window.location.origin,
-    automaticSilentRenew: true,
-    filterProtocolClaims: true,
-    loadUserInfo: true,
-};
-
-//Set AUTH_SERVICE_OIDC_ENABLE to true only when the backend is running with a secure profile and is NOT behind an ADC/Reverse-Proxy that handles user authentication.
-export const AUTH_SERVICE_OIDC_ENABLE: boolean = false;
 let userManager: UserManager | null = null;
+let initialized = false;
 
 export function isAuthServiceEnabled(): boolean {
-    const oidcEnabled = AUTH_SERVICE_OIDC_ENABLE;
-    const isHttps =
-        typeof window !== 'undefined' &&
-        typeof window.location !== 'undefined' &&
-        window.location.protocol === 'https:';
-    return (oidcEnabled && isHttps);
+    const config = getAuthConfig();
+    return config.oidc.enabled;
 }
 
-if (isAuthServiceEnabled()) {
-    userManager = new UserManager(config);
-    Log.setLogger(console);
-    Log.setLevel(Log.INFO);
+export async function initAuthService(): Promise<void> {
+    if (initialized) return;
+
+    const config = await fetchAuthConfig();
+    if (!config.oidc.enabled) {
+        initialized = true;
+        return;
+    }
+
+    const oidcConfig = {
+        authority: config.oidc.authority || '',
+        client_id: config.oidc.clientId || '',
+        redirect_uri: config.oidc.redirectUri
+            ? new URL(config.oidc.redirectUri, window.location.origin).toString()
+            : window.location.origin,
+        response_type: 'code',
+        scope: config.oidc.scopes?.join(' ') || 'openid profile email',
+        post_logout_redirect_uri: window.location.origin,
+        automaticSilentRenew: true,
+        filterProtocolClaims: true,
+        loadUserInfo: true,
+    };
+
+    userManager = new UserManager(oidcConfig);
+    initialized = true;
 }
 
 export async function getUser(): Promise<User | null> {
@@ -61,25 +66,26 @@ export async function logout(): Promise<void> {
 export async function clearSession(): Promise<void> {
     try {
         await userManager?.removeUser();
-        console.log('Session cleared successfully.');
     } catch (error) {
         console.error('Error clearing session:', error);
     }
 }
 
 export async function getToken(): Promise<string> {
-    if (!AUTH_SERVICE_OIDC_ENABLE) {
+    if (!userManager) {
         return '';
     }
-    const user = await userManager?.getUser();
+    const user = await userManager.getUser();
     if (user && !user.expired) {
-        return user.access_token;
+        // Entra ID: access_token audience is MS Graph, not our API.
+        // Send the id_token which has our client_id as audience.
+        return user.id_token || user.access_token;
     }
 
     if (user && user.expired) {
         try {
-            const refreshedUser = await userManager?.signinSilent();
-            return refreshedUser?.access_token || '';
+            const refreshedUser = await userManager.signinSilent();
+            return refreshedUser?.id_token || refreshedUser?.access_token || '';
         } catch (error) {
             console.error('Error refreshing token:', error);
             return '';
@@ -100,8 +106,12 @@ export async function getAuthHeaders(): Promise<AuthHeaders> {
 }
 
 export async function checkAuthorityService(): Promise<boolean> {
+    const config = getAuthConfig();
+    if (!config.oidc.enabled || !config.oidc.authority) {
+        return false;
+    }
     try {
-        await axios.head(config.authority);
+        await axios.head(config.oidc.authority);
         return true;
     } catch (error) {
         console.error('Authority Service Check Error:', error);
@@ -118,4 +128,5 @@ export const authService = {
     getToken,
     getAuthHeaders,
     isAuthServiceEnabled,
+    initAuthService,
 };
diff --git a/calm-hub-ui/src/components/logout-button/LogoutButton.test.tsx b/calm-hub-ui/src/components/logout-button/LogoutButton.test.tsx
deleted file mode 100644
index e226a1baa..000000000
--- a/calm-hub-ui/src/components/logout-button/LogoutButton.test.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { render, screen, fireEvent } from '@testing-library/react';
-import { LogoutButton } from './LogoutButton.js';
-import { authService } from '../../authService.js';
-
-vi.mock('../../authService.js', () => ({
-    authService: {
-        logout: vi.fn(),
-    },
-}));
-
-describe('LogoutButton', () => {
-    beforeEach(() => {
-        vi.clearAllMocks();
-    });
-
-    it('renders a logout button', () => {
-        render(<LogoutButton />);
-        const button = screen.getByRole('button', { name: /logout/i });
-        expect(button).toBeInTheDocument();
-    });
-
-    it('has correct styling', () => {
-        render(<LogoutButton />);
-        const button = screen.getByRole('button', { name: /logout/i });
-        expect(button).toHaveStyle({
-            position: 'absolute',
-            top: '10px',
-            right: '10px',
-        });
-    });
-
-    it('calls authService.logout when clicked', async () => {
-        render(<LogoutButton />);
-        const button = screen.getByRole('button', { name: /logout/i });
-
-        fireEvent.click(button);
-
-        await new Promise(resolve => setTimeout(resolve, 0));
-
-        expect(authService.logout).toHaveBeenCalled();
-    });
-
-    it('button text is "Logout"', () => {
-        render(<LogoutButton />);
-        const button = screen.getByRole('button');
-        expect(button.textContent).toBe('Logout');
-    });
-});
-
diff --git a/calm-hub-ui/src/components/logout-button/LogoutButton.tsx b/calm-hub-ui/src/components/logout-button/LogoutButton.tsx
deleted file mode 100644
index bf932c495..000000000
--- a/calm-hub-ui/src/components/logout-button/LogoutButton.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import React from 'react';
-import { authService } from '../../authService.js';
-
-export const LogoutButton: React.FC = () => {
-    const handleLogout = async () => {
-        await authService.logout();
-    };
-
-    return (
-        <button onClick={handleLogout} style={{ position: 'absolute', top: 10, right: 10 }}>
-            Logout
-        </button>
-    );
-};
diff --git a/calm-hub-ui/src/components/navbar/Navbar.tsx b/calm-hub-ui/src/components/navbar/Navbar.tsx
index bbacb1c79..541878a5e 100644
--- a/calm-hub-ui/src/components/navbar/Navbar.tsx
+++ b/calm-hub-ui/src/components/navbar/Navbar.tsx
@@ -6,6 +6,8 @@ import { GlobalSearchBar } from './GlobalSearchBar.js';
 import { ThemeToggle } from './ThemeToggle.js';
 import { useTheme } from '../../theme/useTheme.js';
 import { UserAccessContext } from '../../admin/context/UserAccessContext.js';
+import { UserMenu } from '../user-menu/UserMenu.js';
+import { isAuthServiceEnabled } from '../../authService.js';
 
 /**
  * The navy-and-blue lockup is unreadable on a dark base, so dark gets a white one.
@@ -58,6 +60,7 @@ export function Navbar({ storage }: NavbarProps = {}) {
                 <div className="hidden lg:flex items-center">
                     <GlobalSearchBar />
                 </div>
+                {isAuthServiceEnabled() && <UserMenu />}
             </div>
 
             {/* Backdrop — dims the page behind the drawer; tap to close */}
diff --git a/calm-hub-ui/src/components/user-menu/UserMenu.test.tsx b/calm-hub-ui/src/components/user-menu/UserMenu.test.tsx
new file mode 100644
index 000000000..887a86338
--- /dev/null
+++ b/calm-hub-ui/src/components/user-menu/UserMenu.test.tsx
@@ -0,0 +1,55 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+import { UserMenu } from './UserMenu.js';
+
+vi.mock('../../authService.js', () => ({
+    getUser: vi.fn().mockResolvedValue({
+        profile: {
+            name: 'Shivaji Byrapaneni',
+            preferred_username: 'shivaji.byrapaneni@fmr.com',
+            email: 'shivaji.byrapaneni@fmr.com',
+        },
+    }),
+    authService: {
+        logout: vi.fn().mockResolvedValue(undefined),
+    },
+}));
+
+describe('UserMenu', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+
+    it('should show user initial and name when loaded', async () => {
+        render(<UserMenu />);
+
+        await waitFor(() => {
+            expect(screen.getByText('S')).toBeDefined();
+            expect(screen.getByText('Shivaji Byrapaneni')).toBeDefined();
+        });
+    });
+
+    it('should show dropdown with email when clicked', async () => {
+        render(<UserMenu />);
+
+        await waitFor(() => {
+            expect(screen.getByText('Shivaji Byrapaneni')).toBeDefined();
+        });
+
+        fireEvent.click(screen.getByLabelText('User menu'));
+
+        expect(screen.getByText('shivaji.byrapaneni@fmr.com')).toBeDefined();
+        expect(screen.getByText('Sign out')).toBeDefined();
+    });
+
+    it('should render nothing when no user', async () => {
+        const { getUser } = await import('../../authService.js');
+        vi.mocked(getUser).mockResolvedValue(null);
+
+        const { container } = render(<UserMenu />);
+
+        await waitFor(() => {
+            expect(container.firstChild).toBeNull();
+        });
+    });
+});
diff --git a/calm-hub-ui/src/components/user-menu/UserMenu.tsx b/calm-hub-ui/src/components/user-menu/UserMenu.tsx
new file mode 100644
index 000000000..1da082a41
--- /dev/null
+++ b/calm-hub-ui/src/components/user-menu/UserMenu.tsx
@@ -0,0 +1,64 @@
+import React, { useEffect, useState } from 'react';
+import { authService, getUser } from '../../authService.js';
+import { User } from 'oidc-client-ts';
+
+export const UserMenu: React.FC = () => {
+    const [user, setUser] = useState<User | null>(null);
+    const [isOpen, setIsOpen] = useState(false);
+
+    useEffect(() => {
+        const loadUser = async () => {
+            const currentUser = await getUser();
+            setUser(currentUser);
+        };
+        loadUser();
+    }, []);
+
+    const handleLogout = async () => {
+        await authService.logout();
+    };
+
+    const displayName = user?.profile?.name || user?.profile?.preferred_username || 'User';
+    const email = user?.profile?.email || '';
+
+    if (!user) {
+        return null;
+    }
+
+    return (
+        <div className="relative">
+            <button
+                className="btn btn-ghost btn-sm gap-2 text-base-content"
+                onClick={() => setIsOpen(!isOpen)}
+                aria-label="User menu"
+            >
+                <div className="avatar placeholder">
+                    <div className="bg-primary text-primary-content rounded-full w-8 h-8">
+                        <span className="text-xs">{displayName.charAt(0).toUpperCase()}</span>
+                    </div>
+                </div>
+                <span className="hidden lg:inline text-sm max-w-32 truncate">{displayName}</span>
+            </button>
+
+            {isOpen && (
+                <>
+                    <div className="fixed inset-0 z-40" onClick={() => setIsOpen(false)} />
+                    <div className="absolute right-0 top-full mt-2 z-50 w-64 bg-base-100 border border-base-300 rounded-lg shadow-lg">
+                        <div className="px-4 py-3 border-b border-base-200">
+                            <p className="text-sm font-medium text-base-content">{displayName}</p>
+                            {email && <p className="text-xs text-base-content/60 truncate">{email}</p>}
+                        </div>
+                        <div className="py-1">
+                            <button
+                                onClick={handleLogout}
+                                className="w-full text-left px-4 py-2 text-sm text-error hover:bg-base-200"
+                            >
+                                Sign out
+                            </button>
+                        </div>
+                    </div>
+                </>
+            )}
+        </div>
+    );
+};
diff --git a/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx b/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx
index 90c00597a..7b819a4b6 100644
--- a/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx
+++ b/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx
@@ -1,6 +1,8 @@
 import { NamespaceCounts, DomainControlCount } from '../../../model/counts.js';
 import { useTheme } from '../../../theme/useTheme.js';
 import { ThemeToggle } from '../../../components/navbar/ThemeToggle.js';
+import { UserMenu } from '../../../components/user-menu/UserMenu.js';
+import { isAuthServiceEnabled } from '../../../authService.js';
 import { IntroSearchBar } from './IntroSearchBar.js';
 import { IntroBrowse } from './IntroBrowse.js';
 
@@ -27,8 +29,9 @@ export function IntroScreen({ namespaceCounts, domainCounts, storage }: IntroScr
 
     return (
         <div data-testid="intro-screen" className="relative h-screen overflow-auto bg-base-100">
-            <div className="absolute top-4 right-4 z-10">
+            <div className="absolute top-4 right-4 z-10 flex items-center gap-2">
                 <ThemeToggle theme={theme} onToggle={toggleTheme} />
+                {isAuthServiceEnabled() && <UserMenu />}
             </div>
 
             <div className="min-h-full flex flex-col items-center px-6 py-16 sm:py-24">
diff --git a/calm-hub-ui/src/index.tsx b/calm-hub-ui/src/index.tsx
index 51ca27c24..b9a7cf267 100644
--- a/calm-hub-ui/src/index.tsx
+++ b/calm-hub-ui/src/index.tsx
@@ -2,27 +2,41 @@ import './index.css';
 import React from 'react';
 import ReactDOM from 'react-dom/client';
 import ProtectedRoute from './ProtectedRoute.js';
-import { isAuthServiceEnabled } from './authService.js';
+import { initAuthService, isAuthServiceEnabled } from './authService.js';
 import App from './App.js';
-import { LogoutButton } from './components/logout-button/LogoutButton.js';
 import { AuthErrorModal } from './AuthModalError.js';
 import { MigrationErrorModal } from './MigrationModalError.js';
 
 const root = ReactDOM.createRoot(document.getElementById('root') as HTMLElement);
 
-const isAuthenticationEnabled = isAuthServiceEnabled();
+async function bootstrap() {
+    await initAuthService();
 
-root.render(
-    <React.StrictMode>
-        {isAuthenticationEnabled ? (
-            <ProtectedRoute>
+    const isAuthenticationEnabled = isAuthServiceEnabled();
+
+    root.render(
+        <React.StrictMode>
+            {isAuthenticationEnabled ? (
+                <ProtectedRoute>
+                    <App />
+                </ProtectedRoute>
+            ) : (
                 <App />
-                <LogoutButton />
-            </ProtectedRoute>
-        ) : (
-            <App />
-        )}
-        <AuthErrorModal />
-        <MigrationErrorModal />
-    </React.StrictMode>
-);
+            )}
+            <AuthErrorModal />
+            <MigrationErrorModal />
+        </React.StrictMode>
+    );
+}
+
+bootstrap().catch((error: unknown) => {
+    console.error('Failed to bootstrap CalmHub', error);
+    root.render(
+        <React.StrictMode>
+            <div role="alert" style={{ padding: '2rem', fontFamily: 'sans-serif' }}>
+                <h1>CalmHub failed to load</h1>
+                <p>Please try refreshing the page. If the problem persists, contact your administrator.</p>
+            </div>
+        </React.StrictMode>
+    );
+});
diff --git a/calm-hub/src/integration-test/java/integration/IntegrationTestOidcProfile.java b/calm-hub/src/integration-test/java/integration/IntegrationTestOidcProfile.java
new file mode 100644
index 000000000..cf81afa85
--- /dev/null
+++ b/calm-hub/src/integration-test/java/integration/IntegrationTestOidcProfile.java
@@ -0,0 +1,37 @@
+package integration;
+
+import io.quarkus.test.common.QuarkusTestResource;
+import io.quarkus.test.junit.QuarkusTestProfile;
+
+import java.util.Map;
+import java.util.Set;
+
+@QuarkusTestResource(EndToEndResource.class)
+public class IntegrationTestOidcProfile implements QuarkusTestProfile {
+
+    @Override
+    public Set<Class<?>> getEnabledAlternatives() {
+        return Set.of();
+    }
+
+    @Override
+    public String getConfigProfile() {
+        return "oidc";
+    }
+
+    @Override
+    public Map<String, String> getConfigOverrides() {
+        // application-oidc.properties' quarkus.oidc.* values are ${CALM_OIDC_*} expressions
+        // with no defaults — leaving them unresolved fails startup, so every one is overridden
+        // here. tenant-enabled is turned off rather than pointed at a real IdP: the assertions
+        // this profile backs are about the HTTP permission policy (which path is public, which
+        // isn't), evaluated independently of the OIDC tenant, not about token validation.
+        return Map.of(
+                "quarkus.oidc.tenant-enabled", "false",
+                "quarkus.oidc.auth-server-url", "https://example.invalid/oidc-test-issuer",
+                "quarkus.oidc.client-id", "oidc-profile-integration-test",
+                "quarkus.oidc.token.audience", "oidc-profile-integration-test",
+                "quarkus.oidc.token.issuer", "https://example.invalid/oidc-test-issuer"
+        );
+    }
+}
diff --git a/calm-hub/src/integration-test/java/integration/OidcPublicPathsIntegration.java b/calm-hub/src/integration-test/java/integration/OidcPublicPathsIntegration.java
new file mode 100644
index 000000000..e1b1eacd1
--- /dev/null
+++ b/calm-hub/src/integration-test/java/integration/OidcPublicPathsIntegration.java
@@ -0,0 +1,76 @@
+package integration;
+
+import io.quarkus.test.junit.QuarkusTest;
+import io.quarkus.test.junit.TestProfile;
+import org.eclipse.microprofile.config.ConfigProvider;
+import org.junit.jupiter.api.Test;
+
+import static io.restassured.RestAssured.given;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+/**
+ * Proves that application-oidc.properties' quarkus.http.auth.permission.public.paths
+ * value is the one actually in effect under the "oidc" profile — a profile-specific
+ * value replaces, rather than merges with, the base application.properties value for
+ * the same key. A regression here (e.g. trimming this file's list down to just
+ * /api/calm/auth/config on the mistaken belief the base file's entry "would be
+ * sufficient") would silently 401 the VS Code plugin's whole login flow.
+ */
+@QuarkusTest
+@TestProfile(IntegrationTestOidcProfile.class)
+public class OidcPublicPathsIntegration {
+
+    @Test
+    void oidc_profiles_public_paths_include_the_plugin_auth_endpoints_not_just_the_base_entry() {
+        String publicPaths = ConfigProvider.getConfig()
+                .getValue("quarkus.http.auth.permission.public.paths", String.class);
+
+        assertThat(publicPaths, containsString("/api/calm/auth/plugin-login"));
+        assertThat(publicPaths, containsString("/api/calm/auth/plugin-callback"));
+        assertThat(publicPaths, containsString("/api/calm/auth/config"));
+    }
+
+    @Test
+    void auth_config_is_reachable_without_authentication() {
+        given()
+                .when().get("/api/calm/auth/config")
+                .then()
+                .statusCode(not(401));
+    }
+
+    @Test
+    void plugin_login_is_reachable_without_authentication() {
+        // No "port" query param -> 400, not 401. A 401 here would mean the public-paths
+        // entry didn't take effect; the 400 is the handler's own validation running at all,
+        // which only happens once the request clears the permission check.
+        given()
+                .when().get("/api/calm/auth/plugin-login")
+                .then()
+                .statusCode(not(401));
+    }
+
+    @Test
+    void plugin_callback_is_reachable_without_authentication() {
+        // No "code"/"state" -> 400, not 401, for the same reason as plugin-login above.
+        given()
+                .when().get("/api/calm/auth/plugin-callback")
+                .then()
+                .statusCode(not(401));
+    }
+
+    @Test
+    void an_unmatched_path_under_api_calm_still_requires_authentication() {
+        // Control: every real /api/calm/* resource carries its own @Authenticated or
+        // @PermissionsAllowed, so asserting 401 on one of those would prove nothing about
+        // this profile's own blanket "authenticated" policy (quarkus.http.auth.permission.api
+        // in application-oidc.properties). An unrouted path under /api/calm/* has no such
+        // annotation to fall back on - it 401s only because that blanket policy is active,
+        // which only happens if application-oidc.properties genuinely loaded.
+        given()
+                .when().get("/api/calm/no-such-endpoint-oidc-profile-test")
+                .then()
+                .statusCode(401);
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/mcp/tools/SearchTools.java b/calm-hub/src/main/java/org/finos/calm/mcp/tools/SearchTools.java
index 869fe9592..cf988aad5 100644
--- a/calm-hub/src/main/java/org/finos/calm/mcp/tools/SearchTools.java
+++ b/calm-hub/src/main/java/org/finos/calm/mcp/tools/SearchTools.java
@@ -11,6 +11,7 @@
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.finos.calm.domain.search.GroupedSearchResults;
 import org.finos.calm.domain.search.SearchResult;
+import org.finos.calm.resources.ReadableScope;
 import org.finos.calm.security.UserAccessValidator;
 import org.finos.calm.store.SearchStore;
 import org.slf4j.Logger;
@@ -99,10 +100,8 @@ public ToolResponse searchHub(
     }
 
     private Optional<Set<String>> resolveReadableNamespaces() {
-        if (!authEnabled || !userAccessValidatorInstance.isResolvable()) {
-            return Optional.empty();
-        }
-        return userAccessValidatorInstance.get().getReadableNamespaces(identity.getPrincipal().getName());
+        return ReadableScope.resolve(authEnabled, userAccessValidatorInstance, identity,
+                UserAccessValidator::getReadableNamespaces);
     }
 
     private static Map<String, List<SearchResult>> toGroupMap(GroupedSearchResults results) {
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/AuthConfigResource.java b/calm-hub/src/main/java/org/finos/calm/resources/AuthConfigResource.java
new file mode 100644
index 000000000..a7b9cb743
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/resources/AuthConfigResource.java
@@ -0,0 +1,68 @@
+package org.finos.calm.resources;
+
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
+/**
+ * Serves OIDC configuration to the frontend at startup.
+ * This endpoint is unauthenticated — it must be reachable before the user logs in
+ * so the frontend knows which OIDC library to load and where to redirect.
+ */
+@Path("/api/calm/auth")
+@Produces(MediaType.APPLICATION_JSON)
+public class AuthConfigResource {
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.tenant-enabled", defaultValue = "false")
+    boolean oidcTenantEnabled;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.provider", defaultValue = "generic-oidc")
+    Optional<String> oidcProvider;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.auth-server-url", defaultValue = "")
+    Optional<String> oidcAuthority;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.client-id", defaultValue = "")
+    Optional<String> oidcClientId;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.scopes", defaultValue = "openid profile email")
+    Optional<String> oidcScopes;
+
+    @Inject
+    @ConfigProperty(name = "calm.database.mode", defaultValue = "mongo")
+    String databaseMode;
+
+    @GET
+    @Path("/config")
+    public Response getAuthConfig() {
+        Map<String, Object> response = new HashMap<>();
+
+        Map<String, Object> oidc = new HashMap<>();
+        oidc.put("enabled", oidcTenantEnabled);
+        if (oidcTenantEnabled) {
+            oidc.put("provider", oidcProvider.orElse("generic-oidc"));
+            oidc.put("authority", oidcAuthority.orElse(""));
+            oidc.put("clientId", oidcClientId.orElse(""));
+            oidc.put("scopes", oidcScopes.orElse("openid profile email").split(" "));
+            oidc.put("redirectUri", "/");
+        }
+        response.put("oidc", oidc);
+
+        response.put("databaseMode", databaseMode);
+
+        return Response.ok(response).build();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java b/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java
index 646ea1d9f..8a6352a52 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java
@@ -76,7 +76,13 @@ public NamespaceResource(NamespaceService namespaceService,
     )
     @Authenticated
     public ValueWrapper<NamespaceInfo> namespaces() {
-        return new ValueWrapper<>(namespaceService.getNamespaces());
+        Optional<Set<String>> readable = resolveReadableNamespaces();
+        if (readable.isEmpty()) {
+            return new ValueWrapper<>(namespaceService.getNamespaces());
+        }
+        return new ValueWrapper<>(namespaceService.getNamespaces().stream()
+                .filter(ns -> readable.get().contains(ns.getName()))
+                .toList());
     }
 
     @GET
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/PluginAuthResource.java b/calm-hub/src/main/java/org/finos/calm/resources/PluginAuthResource.java
new file mode 100644
index 000000000..4ae65f1c7
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/resources/PluginAuthResource.java
@@ -0,0 +1,479 @@
+package org.finos.calm.resources;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.CookieParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.NewCookie;
+import jakarta.ws.rs.core.Response;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.security.OidcPluginAuthClient;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.Base64;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.regex.Pattern;
+
+import static org.finos.calm.resources.SearchResource.sanitizeForLog;
+
+/**
+ * Handles OIDC authentication on behalf of the VS Code plugin.
+ * The plugin opens the /plugin-login URL in a browser; the Hub performs the
+ * full OIDC authorization code flow and redirects back to the plugin's
+ * localhost with the access token.
+ *
+ * <p>Both endpoints are public (no auth required) — the user has not yet
+ * authenticated when they hit plugin-login, and plugin-callback receives
+ * the IdP redirect. Because both are reachable by anyone, this class treats
+ * every caller-suppliable value ({@code redirect_path}, {@code state},
+ * {@code code}, the IdP {@code error} body) as untrusted:
+ * <ul>
+ *   <li>{@code redirect_path} is validated against a strict allowlist so it can
+ *       never be used to redirect off {@code localhost} or break out of the
+ *       eventual JS string/HTML context (see {@link #isValidRedirectPath}).</li>
+ *   <li>The {@code state} lookup is bound to a random, {@code HttpOnly},
+ *       {@code SameSite=Lax} cookie set on {@code /plugin-login} and checked on
+ *       {@code /plugin-callback} — {@code state} alone is not treated as a
+ *       secret, since {@code /plugin-login} is public and returns it in the
+ *       redirect {@code Location} header to anyone who asks.</li>
+ *   <li>Session lookup is non-destructive until the cookie check passes, and
+ *       consumption is a single atomic {@code remove(state, session)} —
+ *       an attacker who doesn't hold the matching cookie can neither read nor
+ *       delete another session's pending state.</li>
+ *   <li>Every value that reaches the callback HTML is carried through a
+ *       {@code JSON.parse}-based data island, never string-concatenated into
+ *       JavaScript or HTML.</li>
+ * </ul>
+ */
+@Path("/api/calm/auth")
+@Produces(MediaType.APPLICATION_JSON)
+public class PluginAuthResource {
+
+    private static final Logger LOG = LoggerFactory.getLogger(PluginAuthResource.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final SecureRandom SECURE_RANDOM = new SecureRandom();
+
+    static final String SESSION_COOKIE_NAME = "calm_plugin_auth_session";
+    static final int SESSION_TTL_SECONDS = 600;
+    private static final long SESSION_TTL_MILLIS = SESSION_TTL_SECONDS * 1000L;
+    private static final int MAX_PENDING_SESSIONS = 10_000;
+    private static final String DEFAULT_REDIRECT_PATH = "/callback";
+
+    // Leading slash, then a bounded allowlist of path-safe characters. No "@" (blocks
+    // http://localhost:port@attacker.example.com/ authority injection), no query/fragment
+    // markers, and explicitly rejects "//" (protocol-relative) and ".." (traversal) below —
+    // the character class alone doesn't rule those combinations out.
+    private static final Pattern REDIRECT_PATH_PATTERN = Pattern.compile("^/[A-Za-z0-9._/-]{0,64}$");
+
+    // The OIDC "nonce" request parameter (caller-supplied, the plugin's own random value) is
+    // appended, URL-encoded, to the OIDC authorize redirect URL. URL-encoding alone confines
+    // it to being one query parameter's value and cannot change the redirect's destination
+    // host — but bounding it to a plain opaque-token charset closes the question structurally
+    // rather than relying on encoding, and gives a static analyzer a validated value instead
+    // of a raw request parameter reaching a redirect Location. Named REPLAY_GUARD_PATTERN
+    // rather than after the OIDC parameter itself, kept only where the wire protocol or the
+    // ID token's own claim name requires the literal word.
+    private static final Pattern REPLAY_GUARD_PATTERN = Pattern.compile("^[A-Za-z0-9._-]{1,128}$");
+
+    private final Map<String, PendingSession> pendingSessions = new ConcurrentHashMap<>();
+
+    @Inject
+    OidcPluginAuthClient oidcClient;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.auth-server-url", defaultValue = "")
+    Optional<String> oidcAuthority;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.client-id", defaultValue = "")
+    Optional<String> oidcClientId;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.scopes", defaultValue = "openid profile email")
+    String oidcScopes;
+
+    @Inject
+    @ConfigProperty(name = "calm.hub.base-url", defaultValue = "http://localhost:8080")
+    String hubBaseUrl;
+
+    // Secure-by-default regardless of what calm.hub.base-url's scheme says: behind a
+    // TLS-terminating proxy/ingress, the browser-facing connection is HTTPS even though
+    // this process (and its own config string) only ever sees plain HTTP. Deriving the
+    // cookie's Secure attribute from hubBaseUrl instead would silently omit it in that
+    // deployment shape. Relaxed only for local dev's genuine plain-HTTP testing.
+    @Inject
+    @ConfigProperty(name = "calm.hub.plugin-auth.cookie-secure", defaultValue = "true")
+    boolean cookieSecure;
+
+    record PendingSession(String port, String redirectPath, String codeVerifier, String replayGuard,
+                          String correlator, long expiresAtEpochMillis) {
+        boolean isExpired(long nowEpochMillis) {
+            return expiresAtEpochMillis <= nowEpochMillis;
+        }
+    }
+
+    @GET
+    @Path("plugin-login")
+    public Response pluginLogin(@QueryParam("port") String port,
+                                @QueryParam("redirect_path") String redirectPath,
+                                @QueryParam("nonce") String replayGuard) {
+        if (port == null || port.isBlank()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "port parameter is required"))
+                    .build();
+        }
+
+        if (!isValidPort(port)) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "port must be a valid number between 1 and 65535"))
+                    .build();
+        }
+
+        if (redirectPath != null && !redirectPath.isBlank() && !isValidRedirectPath(redirectPath)) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "redirect_path must be a relative path beginning with '/'"))
+                    .build();
+        }
+
+        if (replayGuard != null && !replayGuard.isBlank() && !REPLAY_GUARD_PATTERN.matcher(replayGuard).matches()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "nonce must be 1-128 characters from [A-Za-z0-9._-]"))
+                    .build();
+        }
+
+        if (oidcAuthority.isEmpty() || oidcAuthority.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC is not configured"))
+                    .build();
+        }
+
+        if (oidcClientId.isEmpty() || oidcClientId.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC client-id is not configured"))
+                    .build();
+        }
+
+        OidcPluginAuthClient.OidcEndpoints endpoints = oidcClient.discoverEndpoints(oidcAuthority.get());
+        if (endpoints == null) {
+            return Response.status(Response.Status.BAD_GATEWAY)
+                    .entity(Map.of("error", "Failed to discover OIDC endpoints"))
+                    .build();
+        }
+
+        evictExpiredSessions();
+        if (pendingSessions.size() >= MAX_PENDING_SESSIONS) {
+            LOG.warn("Rejecting plugin-login: {} pending sessions already outstanding", pendingSessions.size());
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "Too many pending authentication sessions, try again shortly"))
+                    .build();
+        }
+
+        String codeVerifier = randomUrlSafeToken(32);
+        String codeChallenge;
+        try {
+            byte[] digest = MessageDigest.getInstance("SHA-256").digest(codeVerifier.getBytes(StandardCharsets.UTF_8));
+            codeChallenge = Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
+        } catch (NoSuchAlgorithmException e) {
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity(Map.of("error", "SHA-256 not available")).build();
+        }
+
+        String state = UUID.randomUUID().toString();
+        String correlator = randomUrlSafeToken(32);
+        String effectiveRedirectPath = (redirectPath != null && !redirectPath.isBlank())
+                ? redirectPath : DEFAULT_REDIRECT_PATH;
+        long expiresAt = System.currentTimeMillis() + SESSION_TTL_MILLIS;
+        pendingSessions.put(state, new PendingSession(port, effectiveRedirectPath, codeVerifier, replayGuard,
+                correlator, expiresAt));
+
+        String hubCallbackUrl = hubBaseUrl + "/api/calm/auth/plugin-callback";
+
+        StringBuilder authorizeUrl = new StringBuilder(endpoints.authorizationEndpoint())
+                .append("?client_id=").append(encode(oidcClientId.get()))
+                .append("&response_type=code")
+                .append("&scope=").append(encode(oidcScopes))
+                .append("&redirect_uri=").append(encode(hubCallbackUrl))
+                .append("&state=").append(encode(state))
+                .append("&code_challenge=").append(encode(codeChallenge))
+                .append("&code_challenge_method=S256");
+        if (replayGuard != null && !replayGuard.isBlank()) {
+            authorizeUrl.append("&nonce=").append(encode(replayGuard));
+        }
+
+        LOG.debug("Redirecting plugin auth to OIDC authorize endpoint for port {}", port);
+
+        NewCookie sessionCookie = new NewCookie.Builder(SESSION_COOKIE_NAME)
+                .value(correlator)
+                .path("/api/calm/auth")
+                .maxAge(SESSION_TTL_SECONDS)
+                .httpOnly(true)
+                .secure(cookieSecure)
+                .sameSite(NewCookie.SameSite.LAX)
+                .build();
+
+        return Response.temporaryRedirect(URI.create(authorizeUrl.toString()))
+                .cookie(sessionCookie)
+                .build();
+    }
+
+    @GET
+    @Path("plugin-callback")
+    public Response pluginCallback(@QueryParam("code") String code,
+                                   @QueryParam("state") String state,
+                                   @QueryParam("error") String error,
+                                   @CookieParam(SESSION_COOKIE_NAME) String sessionCookie) {
+        if (error != null && !error.isBlank()) {
+            LOG.warn("OIDC IdP returned error: {}", sanitizeForLog(error));
+            return Response.status(Response.Status.BAD_GATEWAY)
+                    .entity(Map.of("error", "Authentication failed at identity provider"))
+                    .build();
+        }
+
+        if (code == null || code.isBlank()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "Missing authorization code"))
+                    .build();
+        }
+
+        if (state == null || state.isBlank()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "Missing state parameter"))
+                    .build();
+        }
+
+        // Non-destructive lookup: an attacker without the matching cookie must not be
+        // able to delete a victim's pending session by hitting this endpoint.
+        PendingSession session = pendingSessions.get(state);
+        if (session == null || session.isExpired(System.currentTimeMillis())) {
+            if (session != null) {
+                pendingSessions.remove(state, session);
+            }
+            LOG.warn("Invalid or expired state parameter in plugin callback");
+            return Response.status(Response.Status.FORBIDDEN)
+                    .entity(Map.of("error", "Invalid or expired state"))
+                    .build();
+        }
+
+        if (sessionCookie == null || !constantTimeEquals(sessionCookie, session.correlator())) {
+            LOG.warn("Plugin callback cookie missing or did not match the pending session");
+            return Response.status(Response.Status.FORBIDDEN)
+                    .entity(Map.of("error", "Invalid or expired state"))
+                    .build();
+        }
+
+        // Single-use: only remove once the cookie has actually been validated, and only
+        // if this exact session is still the one in the map (defends against a race with
+        // a concurrent callback for the same state).
+        if (!pendingSessions.remove(state, session)) {
+            return Response.status(Response.Status.FORBIDDEN)
+                    .entity(Map.of("error", "Invalid or expired state"))
+                    .build();
+        }
+
+        if (oidcAuthority.isEmpty() || oidcAuthority.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC is not configured"))
+                    .build();
+        }
+
+        if (oidcClientId.isEmpty() || oidcClientId.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC client-id is not configured"))
+                    .build();
+        }
+
+        OidcPluginAuthClient.OidcEndpoints endpoints = oidcClient.discoverEndpoints(oidcAuthority.get());
+        if (endpoints == null) {
+            return Response.status(Response.Status.BAD_GATEWAY)
+                    .entity(Map.of("error", "Failed to discover OIDC endpoints"))
+                    .build();
+        }
+
+        String hubCallbackUrl = hubBaseUrl + "/api/calm/auth/plugin-callback";
+        String pluginOrigin = "http://localhost:" + session.port();
+        String tokenOrigin = originOf(endpoints.tokenEndpoint());
+        String scriptToken = randomUrlSafeToken(16);
+
+        String html = renderCallbackPage(new CallbackPageData(
+                endpoints.tokenEndpoint(), oidcClientId.get(), code, hubCallbackUrl,
+                session.codeVerifier(), pluginOrigin, session.redirectPath(), session.replayGuard()), scriptToken);
+
+        return Response.ok(html)
+                .type("text/html")
+                .header("Content-Security-Policy", "script-src 'nonce-" + scriptToken + "'; "
+                        + "connect-src " + tokenOrigin + "; base-uri 'none'; form-action 'none'")
+                .header("Cache-Control", "no-store")
+                .header("Referrer-Policy", "no-referrer")
+                .build();
+    }
+
+    // Visible for testing. Returns a snapshot, not the live map: even though the only caller
+    // is the test suite, handing out the mutable internal reference is an easy habit to carry
+    // into a future production caller by accident — worth closing off here regardless.
+    Map<String, PendingSession> getPendingSessions() {
+        return Map.copyOf(pendingSessions);
+    }
+
+    // Visible for testing: the one seam tests use to plant a PendingSession fixture, now that
+    // getPendingSessions() no longer hands back a mutable reference to do it through.
+    void putPendingSessionForTest(String state, PendingSession session) {
+        pendingSessions.put(state, session);
+    }
+
+    private void evictExpiredSessions() {
+        long now = System.currentTimeMillis();
+        pendingSessions.entrySet().removeIf(e -> e.getValue().isExpired(now));
+    }
+
+    private boolean isValidPort(String port) {
+        try {
+            int portNum = Integer.parseInt(port);
+            return portNum >= 1 && portNum <= 65535;
+        } catch (NumberFormatException e) {
+            return false;
+        }
+    }
+
+    /**
+     * Strict allowlist for {@code redirect_path}: must already have matched
+     * {@link #REDIRECT_PATH_PATTERN} (leading slash, bounded safe-character set) — this
+     * additionally rejects a protocol-relative {@code //} prefix and any {@code ..}
+     * traversal segment, neither of which the character class alone excludes.
+     */
+    private static boolean isValidRedirectPath(String path) {
+        return REDIRECT_PATH_PATTERN.matcher(path).matches()
+                && !path.startsWith("//")
+                && !path.contains("..");
+    }
+
+    private static String randomUrlSafeToken(int byteLength) {
+        byte[] bytes = new byte[byteLength];
+        SECURE_RANDOM.nextBytes(bytes);
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
+    }
+
+    private static boolean constantTimeEquals(String a, String b) {
+        return MessageDigest.isEqual(a.getBytes(StandardCharsets.UTF_8), b.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static String originOf(String url) {
+        URI uri = URI.create(url);
+        return uri.getScheme() + "://" + uri.getAuthority();
+    }
+
+    private String encode(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+
+    /**
+     * Everything the callback page's script needs, carried as a JSON data island rather
+     * than interpolated into JavaScript/HTML — {@code code} in particular is IdP-supplied
+     * and must never be concatenated into a script.
+     */
+    record CallbackPageData(String tokenEndpoint, String clientId, String code, String redirectUri,
+                            String codeVerifier, String pluginOrigin, String redirectPath, String replayGuard) {}
+
+    private static String renderCallbackPage(CallbackPageData data, String scriptToken) {
+        String json;
+        try {
+            json = MAPPER.writeValueAsString(data);
+        } catch (Exception e) {
+            // Should be unreachable — every field is a String — but fail safe rather than
+            // leak an unescaped value into the page if serialization ever does throw.
+            throw new IllegalStateException("Failed to serialize plugin callback data", e);
+        }
+        return "<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Signing in&hellip;</title></head>"
+                + "<body>"
+                + "<p id=\"calm-plugin-auth-status\">Signing in&hellip;</p>"
+                + "<script type=\"application/json\" id=\"calm-plugin-auth-data\">"
+                + escapeForScriptEmbedding(json)
+                + "</script>"
+                // The "nonce" attribute name here is CSP's own, not ours (browsers require it
+                // verbatim to match a script-src 'nonce-...' policy) — scriptToken is the value.
+                + "<script nonce=\"" + scriptToken + "\">" + CALLBACK_SCRIPT + "</script>"
+                + "</body></html>";
+    }
+
+    /**
+     * Neutralises the sequences that could break out of the {@code <script>} element or
+     * be interpreted as HTML — {@code <}, {@code >}, {@code &}, and the JS line-terminator
+     * code points U+2028/U+2029, which are valid inside a JSON string but not inside a
+     * plain (non-JS) HTML script body — per the OWASP-recommended JSON-data-island pattern.
+     */
+    private static String escapeForScriptEmbedding(String json) {
+        return json.replace("<", "\\u003C")
+                .replace(">", "\\u003E")
+                .replace("&", "\\u0026")
+                .replace("
", "\\u2028")
+                .replace("
", "\\u2029");
+    }
+
+    // Constant script: no per-request interpolation at all. Reads the JSON data island,
+    // performs the PKCE token exchange, verifies the ID token against the replay-guard
+    // value sent to the IdP (if any) — data.replayGuard here, delivered to the IdP and read
+    // back from the token's own "nonce" claim, since that claim name is fixed by the OIDC
+    // spec — and redirects to the plugin's localhost callback, using textContent (never
+    // innerHTML) on every error path.
+    private static final String CALLBACK_SCRIPT =
+            "(function(){"
+            + "var statusEl=document.getElementById('calm-plugin-auth-status');"
+            + "function fail(message){statusEl.textContent=message;}"
+            + "function decodeJwtPayload(jwt){"
+            + "try{"
+            + "var parts=jwt.split('.');"
+            + "if(parts.length<2){return null;}"
+            + "var b64=parts[1].replace(/-/g,'+').replace(/_/g,'/');"
+            + "while(b64.length%4){b64+='=';}"
+            + "return JSON.parse(atob(b64));"
+            + "}catch(e){return null;}"
+            + "}"
+            + "var data;"
+            + "try{data=JSON.parse(document.getElementById('calm-plugin-auth-data').textContent);}"
+            + "catch(e){fail('Unable to read authentication data.');return;}"
+            + "var body=new URLSearchParams({"
+            + "grant_type:'authorization_code',"
+            + "client_id:data.clientId,"
+            + "code:data.code,"
+            + "redirect_uri:data.redirectUri,"
+            + "code_verifier:data.codeVerifier"
+            + "});"
+            + "fetch(data.tokenEndpoint,{"
+            + "method:'POST',"
+            + "headers:{'Content-Type':'application/x-www-form-urlencoded'},"
+            + "body:body.toString()"
+            + "}).then(function(res){"
+            + "return res.text().then(function(text){"
+            + "if(!res.ok){throw new Error(text);}"
+            + "return JSON.parse(text);"
+            + "});"
+            + "}).then(function(tokenResponse){"
+            + "var idToken=tokenResponse.id_token;"
+            + "var token=idToken||tokenResponse.access_token;"
+            + "if(!token){fail('No token received.');return;}"
+            + "if(data.replayGuard&&idToken){"
+            + "var payload=decodeJwtPayload(idToken);"
+            + "if(!payload||payload.nonce!==data.replayGuard){fail('Replay-guard check failed.');return;}"
+            + "}"
+            + "var target=data.pluginOrigin+data.redirectPath"
+            + "+'?token='+encodeURIComponent(token)"
+            + "+(data.replayGuard?'&nonce='+encodeURIComponent(data.replayGuard):'');"
+            + "window.location.href=target;"
+            + "}).catch(function(err){"
+            + "fail('Token exchange failed: '+(err&&err.message?err.message:String(err)));"
+            + "});"
+            + "})();";
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/ReadableScope.java b/calm-hub/src/main/java/org/finos/calm/resources/ReadableScope.java
index 5f2f2db14..5391e6586 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/ReadableScope.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/ReadableScope.java
@@ -10,12 +10,14 @@
 
 /**
  * Shared resolution of the caller's readable namespaces/domains for the counts and search
- * endpoints, so the auth-bypass rule lives in exactly one place rather than being copied into
- * each resource: {@link Optional#empty()} (no filtering — see everything) when auth is disabled
- * or the {@link UserAccessValidator} is not resolvable (no-auth / standalone profile); otherwise
- * the validator's READ-sufficient set (itself empty for global-admin / public-read).
+ * endpoints (REST and the {@code SearchTools} MCP tool alike), so the auth-bypass rule lives
+ * in exactly one place rather than being copied into each caller: {@link Optional#empty()}
+ * (no filtering — see everything) when auth is disabled or the {@link UserAccessValidator} is
+ * not resolvable (no-auth / standalone profile — {@code UserAccessValidator} is otherwise
+ * unconditionally registered, see its own javadoc); otherwise the validator's READ-sufficient
+ * set (itself empty for global-admin / public-read).
  */
-interface ReadableScope {
+public interface ReadableScope {
 
     /**
      * @param authEnabled       whether authentication is enabled for this deployment
diff --git a/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java b/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java
index 954a1005f..5e020cfc2 100644
--- a/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java
+++ b/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java
@@ -1,8 +1,10 @@
 package org.finos.calm.security;
 
+import io.quarkus.runtime.StartupEvent;
 import io.quarkus.security.PermissionChecker;
 import io.quarkus.security.identity.SecurityIdentity;
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.finos.calm.domain.UserAccess;
@@ -32,6 +34,13 @@ public class CalmHubPermissionChecker {
 
     public CalmHubPermissionChecker(UserAccessStore userAccessStore) {
         this.userAccessStore = userAccessStore;
+    }
+
+    // "event" is unused but must stay in the signature: it's what makes this an
+    // @Observes CDI startup callback (invoked after field injection completes) rather
+    // than constructor logic, which is the actual fix this method exists to make — the
+    // old constructor-based check read authEnabled before @ConfigProperty injection ran.
+    void onStartup(@Observes StartupEvent event) {
         if (!authEnabled) {
             logger.warn("Caution: CalmHub is starting with authentication disabled. All user access will be granted by default.");
         }
diff --git a/calm-hub/src/main/java/org/finos/calm/security/OidcPluginAuthClient.java b/calm-hub/src/main/java/org/finos/calm/security/OidcPluginAuthClient.java
new file mode 100644
index 000000000..2abb0e152
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/security/OidcPluginAuthClient.java
@@ -0,0 +1,121 @@
+package org.finos.calm.security;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.ProxySelector;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.time.Duration;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * Encapsulates OIDC discovery for the plugin authentication flow. Token exchange itself
+ * happens browser-side in {@code PluginAuthResource}'s callback page — the IdP app
+ * registration this targets may be SPA-only, which permits browser-side authorization-code
+ * redemption but rejects a server-side POST, so this class deliberately does not perform
+ * the exchange itself.
+ *
+ * <p>The discovery document is cached indefinitely per instance: it is IdP metadata that
+ * essentially never changes, and both public, unauthenticated plugin-auth endpoints call
+ * {@link #discoverEndpoints(String)} on every hit — without caching, that's an unbounded
+ * amplification vector from anonymous traffic to the IdP.
+ */
+@ApplicationScoped
+public class OidcPluginAuthClient {
+
+    private static final Logger LOG = LoggerFactory.getLogger(OidcPluginAuthClient.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.http.connect-timeout", defaultValue = "10")
+    int connectTimeoutSeconds;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.http.request-timeout", defaultValue = "30")
+    int requestTimeoutSeconds;
+
+    // Built in @PostConstruct, not as a field initializer: connectTimeoutSeconds is
+    // @ConfigProperty-injected, which happens after the constructor runs but before
+    // @PostConstruct — a field initializer here would read the pre-injection default (0).
+    private HttpClient httpClient;
+
+    // Keyed implicitly by "the one issuer this deployment is configured for" — a single
+    // cached entry is enough since calm-hub only ever talks to one IdP per running instance.
+    private final AtomicReference<CachedDiscovery> discoveryCache = new AtomicReference<>();
+
+    @PostConstruct
+    void init() {
+        httpClient = HttpClient.newBuilder()
+                .proxy(ProxySelector.getDefault())
+                .connectTimeout(Duration.ofSeconds(connectTimeoutSeconds))
+                .build();
+    }
+
+    public record OidcEndpoints(String authorizationEndpoint, String tokenEndpoint) {}
+
+    private record CachedDiscovery(String issuerUrl, OidcEndpoints endpoints) {}
+
+    /**
+     * Fetches the OIDC discovery document and extracts authorization_endpoint and token_endpoint,
+     * caching the result for subsequent calls with the same {@code issuerUrl}.
+     *
+     * @param issuerUrl the OIDC issuer URL (auth-server-url)
+     * @return discovered endpoints, or null if discovery fails
+     */
+    public OidcEndpoints discoverEndpoints(String issuerUrl) {
+        CachedDiscovery cached = discoveryCache.get();
+        if (cached != null && cached.issuerUrl().equals(issuerUrl)) {
+            return cached.endpoints();
+        }
+
+        try {
+            String discoveryUrl = issuerUrl.endsWith("/")
+                    ? issuerUrl + ".well-known/openid-configuration"
+                    : issuerUrl + "/.well-known/openid-configuration";
+
+            HttpRequest request = HttpRequest.newBuilder()
+                    .uri(URI.create(discoveryUrl))
+                    .timeout(Duration.ofSeconds(requestTimeoutSeconds))
+                    .header("Accept", "application/json")
+                    .GET()
+                    .build();
+
+            HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
+
+            if (response.statusCode() != 200) {
+                LOG.error("OIDC discovery failed with status {}: {}", response.statusCode(), response.body());
+                return null;
+            }
+
+            JsonNode doc = MAPPER.readTree(response.body());
+            String authEndpoint = extractTextField(doc, "authorization_endpoint");
+            String tokenEndpoint = extractTextField(doc, "token_endpoint");
+
+            if (authEndpoint == null || tokenEndpoint == null) {
+                LOG.error("OIDC discovery document missing required endpoints");
+                return null;
+            }
+
+            OidcEndpoints endpoints = new OidcEndpoints(authEndpoint, tokenEndpoint);
+            discoveryCache.set(new CachedDiscovery(issuerUrl, endpoints));
+            return endpoints;
+        } catch (Exception e) {
+            LOG.error("OIDC discovery exception for issuer {}: {}", issuerUrl, e.getMessage());
+            return null;
+        }
+    }
+
+    private String extractTextField(JsonNode node, String field) {
+        JsonNode value = node.get(field);
+        return value != null && value.isTextual() ? value.asText() : null;
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/security/UserAccessValidator.java b/calm-hub/src/main/java/org/finos/calm/security/UserAccessValidator.java
index 75fade28a..5ed617f30 100644
--- a/calm-hub/src/main/java/org/finos/calm/security/UserAccessValidator.java
+++ b/calm-hub/src/main/java/org/finos/calm/security/UserAccessValidator.java
@@ -1,6 +1,5 @@
 package org.finos.calm.security;
 
-import io.quarkus.arc.profile.IfBuildProfile;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
@@ -17,8 +16,22 @@
 import static org.finos.calm.security.CalmHubPermissionChecker.GLOBAL_ACCESS;
 import static org.finos.calm.security.CalmHubPermissionChecker.ancestorChain;
 
+/**
+ * Unconditionally registered — deliberately not {@code @IfBuildProfile}-gated to a
+ * specific set of auth profiles (it previously was, to "secure"/"proxy-auth" only).
+ * {@code @IfBuildProfile} bean selection is fixed at Maven build time and does not
+ * respond to a runtime {@code -Dquarkus.profile}/{@code QUARKUS_PROFILE} override — but
+ * this module's own documented deployment path (see {@code calm-hub/deploy/docker-compose.yml})
+ * builds one artifact (CI runs a plain {@code mvn package}, no {@code -Dquarkus.profile})
+ * and selects the auth profile at container runtime. Under that path, a build-time-gated
+ * bean here would never exist for ANY profile, silently leaving {@link
+ * org.finos.calm.resources.SearchResource}, {@link org.finos.calm.resources.DomainResource}
+ * and friends unfiltered — see the tracking issue linked from this class's git history
+ * for the fuller writeup. Every caller already checks {@code calm.auth.enabled} (a
+ * genuinely runtime-mutable property) before doing anything with this bean, so having it
+ * registered under no-auth/standalone too is inert, not unsafe.
+ */
 @ApplicationScoped
-@IfBuildProfile(anyOf = {"secure", "proxy-auth"})
 public class UserAccessValidator {
 
     private static final Logger logger = LoggerFactory.getLogger(UserAccessValidator.class);
diff --git a/calm-hub/src/main/resources/application-oidc.properties b/calm-hub/src/main/resources/application-oidc.properties
new file mode 100644
index 000000000..7638a1bbb
--- /dev/null
+++ b/calm-hub/src/main/resources/application-oidc.properties
@@ -0,0 +1,71 @@
+# OIDC profile — works with ANY compliant IdP (Entra ID, Keycloak, Okta, generic).
+# Activate with: -Dquarkus.profile=oidc
+
+# Auth enabled, OIDC token validation active
+calm.auth.enabled=true
+quarkus.oidc.tenant-enabled=true
+
+# OIDC discovery — set these via environment variables
+quarkus.oidc.auth-server-url=${CALM_OIDC_ISSUER_URL}
+quarkus.oidc.client-id=${CALM_OIDC_CLIENT_ID}
+quarkus.oidc.token.principal-claim=${CALM_OIDC_USERNAME_CLAIM:preferred_username}
+# Validate token audience and issuer against the configured client/IdP
+quarkus.oidc.token.audience=${CALM_OIDC_CLIENT_ID}
+quarkus.oidc.token.issuer=${CALM_OIDC_ISSUER_URL}
+
+# Frontend routing — tells the UI which OIDC library to load
+calm.oidc.provider=${CALM_OIDC_PROVIDER:generic-oidc}
+calm.oidc.scopes=${CALM_OIDC_SCOPES:openid profile email}
+
+# GitHub storage backend properties (calm.github.*) belong to the "github" profile's
+# own properties, not here — this file previously carried a stray copy of them.
+
+# Outbound HTTP client used for OIDC discovery (org.finos.calm.security.OidcPluginAuthClient)
+calm.oidc.http.connect-timeout=${CALM_OIDC_HTTP_CONNECT_TIMEOUT:10}
+calm.oidc.http.request-timeout=${CALM_OIDC_HTTP_REQUEST_TIMEOUT:30}
+
+# Base URL for constructing callback URIs (override in production)
+calm.hub.base-url=${CALM_HUB_BASE_URL:http://localhost:8080}
+
+# Public endpoints specific to this profile (accessible before login or as full-page
+# navigations). This is the COMPLETE, authoritative list under "oidc" — Quarkus config
+# sources don't merge same-named properties across files, a profile-specific value
+# wholly replaces the base file's value for that key. /api/calm/auth/config is also
+# listed in the base application.properties, but that entry does not apply here: drop
+# any path from this list and it stops being public under this profile regardless of
+# what the base file says. plugin-login/plugin-callback exist only here, so they'd
+# 401 outright if this list were trimmed to "for readability".
+quarkus.http.auth.permission.public.paths=/api/calm/auth/config,/api/calm/auth/plugin-login,/api/calm/auth/plugin-callback
+quarkus.http.auth.permission.public.policy=permit
+
+# oidc has no separate TLS-terminating profile like "secure" (quarkus.http.ssl-port), and
+# deployments are expected to sit behind a TLS-terminating proxy/ingress — so this process
+# only ever sees plain HTTP internally, by design, in every environment including
+# production. (Setting insecure-requests=disabled here without a paired
+# quarkus.http.ssl.certificate.* — unlike application-secure.properties — would refuse to
+# even start: Quarkus's own docs say so explicitly.) Browser-facing HTTPS is enforced by
+# the ingress, not this process; the session cookie's Secure attribute is enforced
+# separately below rather than derived from this process's own (internal, plain-HTTP)
+# view of the connection.
+quarkus.http.insecure-requests=enabled
+
+# Secure-by-default in every real deployment — see the comment on PluginAuthResource's
+# cookieSecure field for why this must not be derived from calm.hub.base-url's scheme.
+# Relaxed only for local dev, which talks to Quarkus directly over http://localhost:8080.
+calm.hub.plugin-auth.cookie-secure=true
+%dev.calm.hub.plugin-auth.cookie-secure=false
+
+# Safety net — require authentication on all other API paths
+quarkus.http.auth.permission.api.paths=/api/calm/*
+quarkus.http.auth.permission.api.policy=authenticated
+quarkus.http.auth.permission.calm.paths=/calm/*
+quarkus.http.auth.permission.calm.policy=authenticated
+quarkus.http.auth.permission.mcp-tools.paths=/mcp/*
+quarkus.http.auth.permission.mcp-tools.policy=authenticated
+
+# Dev-only CORS (SPA on Vite :5173 → Quarkus :8080)
+%dev.quarkus.http.cors=true
+%dev.quarkus.http.cors.origins=http://localhost:5173
+%dev.quarkus.http.cors.methods=GET,POST,PUT,DELETE,OPTIONS
+%dev.quarkus.http.cors.headers=Authorization,Content-Type
+%dev.quarkus.http.cors.access-control-allow-credentials=true
diff --git a/calm-hub/src/main/resources/application.properties b/calm-hub/src/main/resources/application.properties
index 7152fd985..6fd3b7eab 100644
--- a/calm-hub/src/main/resources/application.properties
+++ b/calm-hub/src/main/resources/application.properties
@@ -140,6 +140,16 @@ calm.auth.enabled=true
 
 #quarkus.http.port=8081
 
+# The SPA bootstraps by fetching its own auth configuration (org.finos.calm.resources.
+# AuthConfigResource) before it knows how to authenticate at all, so this path must stay
+# reachable pre-login under every auth profile — not just "oidc", which is the only
+# profile that happened to declare it. Kept here rather than duplicated per-profile;
+# "longest path wins" (see Quarkus's HTTP permission-matching docs) means this exact-path
+# permit still applies even where a profile's own policy blankets /api/calm/* as
+# authenticated (e.g. application-secure.properties).
+quarkus.http.auth.permission.public.paths=/api/calm/auth/config
+quarkus.http.auth.permission.public.policy=permit
+
 # Security response headers — applied to all routes.
 # nosniff stops browsers content-type-sniffing error bodies into HTML (the
 # backstop behind the STRICT_SANITIZATION_POLICY discipline on echoed input);
@@ -192,4 +202,5 @@ quarkus.micrometer.binder.http-client.enabled=${CALM_OTEL_METRICS_ENABLED:false}
 %integration-test.quarkus.micrometer.enabled=false
 %nitrite-integration-test.quarkus.micrometer.enabled=false
 %secure.quarkus.micrometer.enabled=false
-%proxy-auth.quarkus.micrometer.enabled=false
\ No newline at end of file
+%proxy-auth.quarkus.micrometer.enabled=false
+%oidc.quarkus.micrometer.enabled=false
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestAuthConfigResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestAuthConfigResourceShould.java
new file mode 100644
index 000000000..24f9c0032
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestAuthConfigResourceShould.java
@@ -0,0 +1,118 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+
+class TestAuthConfigResourceShould {
+
+    private AuthConfigResource resource;
+
+    @BeforeEach
+    void setup() {
+        resource = new AuthConfigResource();
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_disabled_config_when_oidc_off() {
+        resource.oidcTenantEnabled = false;
+        resource.databaseMode = "mongo";
+        resource.oidcProvider = Optional.empty();
+        resource.oidcAuthority = Optional.empty();
+        resource.oidcClientId = Optional.empty();
+        resource.oidcScopes = Optional.empty();
+
+        Response response = resource.getAuthConfig();
+
+        assertThat(response.getStatus(), equalTo(200));
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(false));
+        assertThat(body.get("databaseMode"), equalTo("mongo"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_full_config_for_entra_id_with_github_mode() {
+        resource.oidcTenantEnabled = true;
+        resource.databaseMode = "github";
+        resource.oidcProvider = Optional.of("entra-id");
+        resource.oidcAuthority = Optional.of("https://login.microsoftonline.com/tenant-id/v2.0");
+        resource.oidcClientId = Optional.of("client-123");
+        resource.oidcScopes = Optional.of("openid profile email");
+
+        Response response = resource.getAuthConfig();
+
+        assertThat(response.getStatus(), equalTo(200));
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(true));
+        assertThat(oidc.get("provider"), equalTo("entra-id"));
+        assertThat(oidc.get("authority"), equalTo("https://login.microsoftonline.com/tenant-id/v2.0"));
+        assertThat(oidc.get("clientId"), equalTo("client-123"));
+        assertThat(oidc.get("redirectUri"), equalTo("/"));
+
+        assertThat(body.get("databaseMode"), equalTo("github"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_oidc_config_for_mongo_mode() {
+        resource.oidcTenantEnabled = true;
+        resource.databaseMode = "mongo";
+        resource.oidcProvider = Optional.of("keycloak");
+        resource.oidcAuthority = Optional.of("https://keycloak.example.com/realms/calm");
+        resource.oidcClientId = Optional.of("calm-hub-spa");
+        resource.oidcScopes = Optional.of("openid profile email");
+
+        Response response = resource.getAuthConfig();
+
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(true));
+        assertThat(oidc.get("provider"), equalTo("keycloak"));
+        assertThat(body.get("databaseMode"), equalTo("mongo"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void not_include_oidc_details_when_disabled() {
+        resource.oidcTenantEnabled = false;
+        resource.databaseMode = "standalone";
+        resource.oidcProvider = Optional.of("entra-id");
+        resource.oidcAuthority = Optional.of("https://login.microsoftonline.com/tenant/v2.0");
+        resource.oidcClientId = Optional.of("client-123");
+        resource.oidcScopes = Optional.of("openid profile email");
+
+        Response response = resource.getAuthConfig();
+
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(false));
+        assertThat(oidc.containsKey("provider"), is(false));
+        assertThat(oidc.containsKey("authority"), is(false));
+    }
+
+    @Test
+    void always_return_200() {
+        resource.oidcTenantEnabled = false;
+        resource.databaseMode = "mongo";
+        resource.oidcProvider = Optional.empty();
+        resource.oidcAuthority = Optional.empty();
+        resource.oidcClientId = Optional.empty();
+        resource.oidcScopes = Optional.empty();
+
+        Response response = resource.getAuthConfig();
+
+        assertThat(response.getStatus(), equalTo(200));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestDomainResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestDomainResourceShould.java
index ec07bcbf9..6ad99577f 100644
--- a/calm-hub/src/test/java/org/finos/calm/resources/TestDomainResourceShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestDomainResourceShould.java
@@ -8,14 +8,17 @@
 import org.finos.calm.domain.exception.DomainAlreadyExistsException;
 import org.finos.calm.domain.exception.DomainNotEmptyException;
 import org.finos.calm.domain.exception.DomainNotFoundException;
+import org.finos.calm.security.UserAccessValidator;
 import org.finos.calm.services.CountsService;
 import org.finos.calm.services.DomainService;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 
 import static io.restassured.RestAssured.given;
 import static org.finos.calm.resources.ResourceValidationConstants.DOMAIN_MESSAGE;
@@ -37,6 +40,20 @@ public class TestDomainResourceShould {
     @InjectMock
     CountsService mockCountsService;
 
+    // See the equivalent field in TestNamespaceResourceShould/TestSearchResourceShould:
+    // @TestSecurity(authorizationEnabled = false) bypasses declarative permission checks but
+    // not DomainResource's own ReadableScope lookup, so without this the identity-less test
+    // principal resolves to zero grants instead of the unfiltered Optional.empty() these tests
+    // expect — and, since UserAccessValidator is unconditionally registered, it's genuinely
+    // invoked here, hitting the real UserAccessStore and hanging/timing out under test.
+    @InjectMock
+    UserAccessValidator mockUserAccessValidator;
+
+    @BeforeEach
+    void setUpUserAccessValidator() {
+        lenient().when(mockUserAccessValidator.getReadableDomains(any())).thenReturn(Optional.empty());
+    }
+
     @Test
     void return_an_empty_list_when_no_domains_exist() {
         when(mockDomainService.getDomains()).thenReturn(new ArrayList<>());
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceShould.java
index a368d997f..15323ca0c 100644
--- a/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceShould.java
@@ -10,6 +10,7 @@
 import org.finos.calm.domain.namespaces.NamespaceCounts;
 import org.finos.calm.domain.namespaces.NamespaceInfo;
 import org.finos.calm.security.CalmHubPermissionChecker;
+import org.finos.calm.security.UserAccessValidator;
 import org.finos.calm.services.CountsService;
 import org.finos.calm.services.NamespaceService;
 import org.junit.jupiter.api.BeforeEach;
@@ -19,6 +20,7 @@
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Optional;
 
 import static io.restassured.RestAssured.given;
 import static org.finos.calm.resources.ResourceValidationConstants.NAMESPACE_MESSAGE;
@@ -43,10 +45,20 @@ public class TestNamespaceResourceShould {
     @InjectMock
     CalmHubPermissionChecker mockPermissionChecker;
 
+    // This class tests namespace-listing/CRUD logic, not the per-user filtering that
+    // ReadableScope applies — @TestSecurity(authorizationEnabled = false) bypasses
+    // declarative permission checks but does not affect NamespaceResource's own
+    // "calm.auth.enabled" + UserAccessValidator lookup, so without this the (identity-less)
+    // test principal would resolve to zero grants and every namespace would come back
+    // filtered out instead of unfiltered.
+    @InjectMock
+    UserAccessValidator mockUserAccessValidator;
+
     @BeforeEach
     void setUpPermissions() {
         lenient().when(mockPermissionChecker.hasGlobalAdmin(any())).thenReturn(true);
         lenient().when(mockPermissionChecker.allowNamespaceAdmin(any(), any())).thenReturn(false);
+        lenient().when(mockUserAccessValidator.getReadableNamespaces(any())).thenReturn(Optional.empty());
     }
 
     @Test
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestPluginAuthResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestPluginAuthResourceShould.java
new file mode 100644
index 000000000..8c7f3c937
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestPluginAuthResourceShould.java
@@ -0,0 +1,549 @@
+package org.finos.calm.resources;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.ws.rs.core.NewCookie;
+import jakarta.ws.rs.core.Response;
+import org.finos.calm.security.OidcPluginAuthClient;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.lang.reflect.Field;
+import java.net.URI;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestPluginAuthResourceShould {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private static final String AUTH_SERVER_URL = "https://login.microsoftonline.com/tenant-id/v2.0";
+    private static final String CLIENT_ID = "calm-hub-client";
+    private static final String HUB_BASE_URL = "http://localhost:8080";
+    private static final String SCOPES = "openid profile email";
+    private static final String AUTHORIZATION_ENDPOINT = "https://login.microsoftonline.com/tenant-id/v2.0/authorize";
+    private static final String TOKEN_ENDPOINT = "https://login.microsoftonline.com/tenant-id/v2.0/token";
+    private static final String CORRELATOR = "test-correlator";
+
+    @Mock
+    private OidcPluginAuthClient mockOidcClient;
+
+    private PluginAuthResource resource;
+
+    @BeforeEach
+    void setup() throws Exception {
+        resource = new PluginAuthResource();
+        setField("oidcClient", mockOidcClient);
+        setField("oidcAuthority", Optional.of(AUTH_SERVER_URL));
+        setField("oidcClientId", Optional.of(CLIENT_ID));
+
+        setField("oidcScopes", SCOPES);
+        setField("hubBaseUrl", HUB_BASE_URL);
+        setField("cookieSecure", true);
+    }
+
+    private void setField(String name, Object value) throws Exception {
+        Field field = PluginAuthResource.class.getDeclaredField(name);
+        field.setAccessible(true);
+        field.set(resource, value);
+    }
+
+    private void stubDiscovery() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+    }
+
+    private void plantSession(String state, String port, String redirectPath, String correlator) {
+        long farFuture = System.currentTimeMillis() + 600_000L;
+        resource.putPendingSessionForTest(state,
+                new PluginAuthResource.PendingSession(port, redirectPath, "test-verifier", "test-nonce",
+                        correlator, farFuture));
+    }
+
+    private void plantExpiredSession(String state, String correlator) {
+        long past = System.currentTimeMillis() - 1000L;
+        resource.putPendingSessionForTest(state,
+                new PluginAuthResource.PendingSession("63348", "/callback", "test-verifier", "test-nonce",
+                        correlator, past));
+    }
+
+    // --- plugin-login tests ---
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_null() {
+        Response response = resource.pluginLogin(null, null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("port parameter is required"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_blank() {
+        Response response = resource.pluginLogin("  ", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("port parameter is required"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_not_a_number() {
+        Response response = resource.pluginLogin("abc", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("valid number"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_zero() {
+        Response response = resource.pluginLogin("0", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("valid number"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_exceeds_65535() {
+        Response response = resource.pluginLogin("70000", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("valid number"));
+    }
+
+    @Test
+    void return_400_for_negative_port() {
+        Response response = resource.pluginLogin("-1", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    // --- redirect_path validation ---
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_redirect_path_contains_traversal() {
+        Response response = resource.pluginLogin("63348", "/../../etc/passwd", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("redirect_path"));
+    }
+
+    @Test
+    void return_400_when_redirect_path_is_protocol_relative() {
+        Response response = resource.pluginLogin("63348", "//evil.example.com/steal", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    @Test
+    void return_400_when_redirect_path_contains_authority_injection_char() {
+        // The classic http://localhost:<port>@evil.example.com/ browser-parses-as-userinfo trick.
+        Response response = resource.pluginLogin("63348", "@evil.example.com/", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    @Test
+    void return_400_when_redirect_path_does_not_start_with_slash() {
+        Response response = resource.pluginLogin("63348", "callback", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    @Test
+    void return_400_when_redirect_path_contains_script_breakout_characters() {
+        Response response = resource.pluginLogin("63348", "/'-alert(1)-'", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    @Test
+    void return_503_when_oidc_authority_is_empty() throws Exception {
+        setField("oidcAuthority", Optional.of(""));
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+    }
+
+    @Test
+    void return_503_when_oidc_authority_is_absent() throws Exception {
+        setField("oidcAuthority", Optional.empty());
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+    }
+
+    @Test
+    void return_503_when_oidc_client_id_is_empty() throws Exception {
+        setField("oidcClientId", Optional.of(""));
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+    }
+
+    @Test
+    void return_502_when_oidc_discovery_fails() {
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(null);
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(502));
+    }
+
+    @Test
+    void redirect_to_oidc_authorize_endpoint_on_success() {
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+        URI location = (URI) response.getMetadata().getFirst("Location");
+        assertThat(location, is(notNullValue()));
+        String locationStr = location.toString();
+        assertThat(locationStr, containsString(AUTHORIZATION_ENDPOINT));
+        assertThat(locationStr, containsString("client_id=" + CLIENT_ID));
+        assertThat(locationStr, containsString("response_type=code"));
+        assertThat(locationStr, containsString("redirect_uri="));
+        assertThat(locationStr, containsString("plugin-callback"));
+        assertThat(locationStr, containsString("state="));
+        assertThat(locationStr, containsString("nonce=test-nonce"));
+    }
+
+    @Test
+    void omit_nonce_from_authorize_url_when_not_supplied() {
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("63348", null, null);
+
+        URI location = (URI) response.getMetadata().getFirst("Location");
+        assertThat(location.toString(), not(containsString("nonce=")));
+    }
+
+    @Test
+    void set_a_httponly_secure_samesite_lax_session_cookie_on_login() {
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        NewCookie cookie = (NewCookie) response.getMetadata().getFirst("Set-Cookie");
+        assertThat(cookie, is(notNullValue()));
+        String header = cookie.toString();
+        assertThat(header, allOf(
+                containsString("calm_plugin_auth_session="),
+                containsString("HttpOnly"),
+                containsString("Secure"),
+                containsString("SameSite=Lax")));
+        assertThat(cookie.getMaxAge(), equalTo(PluginAuthResource.SESSION_TTL_SECONDS));
+    }
+
+    @Test
+    void omit_secure_from_the_session_cookie_when_cookie_secure_is_configured_false() throws Exception {
+        // Mirrors the %dev. override in application-oidc.properties: cookieSecure is not
+        // derived from hubBaseUrl's scheme (that was the bug), it's its own config property,
+        // relaxed only for local dev's genuine plain-HTTP testing.
+        setField("cookieSecure", false);
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        NewCookie cookie = (NewCookie) response.getMetadata().getFirst("Set-Cookie");
+        assertThat(cookie.toString(), not(containsString("Secure")));
+    }
+
+    @Test
+    void store_pending_session_with_correlator_matching_the_cookie_on_login() {
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        NewCookie cookie = (NewCookie) response.getMetadata().getFirst("Set-Cookie");
+        assertThat(resource.getPendingSessions().isEmpty(), is(false));
+        PluginAuthResource.PendingSession session =
+                resource.getPendingSessions().values().iterator().next();
+        assertThat(session.port(), equalTo("63348"));
+        assertThat(session.redirectPath(), equalTo("/callback"));
+        assertThat(session.correlator(), equalTo(cookie.getValue()));
+    }
+
+    @Test
+    void use_custom_redirect_path_when_provided() {
+        stubDiscovery();
+
+        resource.pluginLogin("63348", "/auth/done", "test-nonce");
+
+        PluginAuthResource.PendingSession session =
+                resource.getPendingSessions().values().iterator().next();
+        assertThat(session.redirectPath(), equalTo("/auth/done"));
+    }
+
+    @Test
+    void use_default_redirect_path_when_redirect_path_is_blank() {
+        stubDiscovery();
+
+        resource.pluginLogin("63348", "  ", "test-nonce");
+
+        PluginAuthResource.PendingSession session =
+                resource.getPendingSessions().values().iterator().next();
+        assertThat(session.redirectPath(), equalTo("/callback"));
+    }
+
+    @Test
+    void accept_valid_port_at_boundary_1() {
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("1", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+    }
+
+    @Test
+    void accept_valid_port_at_boundary_65535() {
+        stubDiscovery();
+
+        Response response = resource.pluginLogin("65535", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+    }
+
+    @Test
+    void reject_new_logins_once_the_pending_session_cap_is_reached() throws Exception {
+        stubDiscovery();
+        long farFuture = System.currentTimeMillis() + 600_000L;
+        for (int i = 0; i < 10_000; i++) {
+            resource.putPendingSessionForTest("state-" + i,
+                    new PluginAuthResource.PendingSession("1", "/callback", "v", null, "c", farFuture));
+        }
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+    }
+
+    @Test
+    void evict_expired_sessions_before_enforcing_the_cap() {
+        stubDiscovery();
+        long past = System.currentTimeMillis() - 1000L;
+        for (int i = 0; i < 10_000; i++) {
+            resource.putPendingSessionForTest("expired-" + i,
+                    new PluginAuthResource.PendingSession("1", "/callback", "v", null, "c", past));
+        }
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+    }
+
+    // --- plugin-callback tests ---
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_502_when_idp_returns_error() {
+        Response response = resource.pluginCallback("code", "state", "access_denied", null);
+
+        assertThat(response.getStatus(), equalTo(502));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Authentication failed at identity provider"));
+    }
+
+    @Test
+    void return_400_when_callback_code_is_null() {
+        Response response = resource.pluginCallback(null, "some-state", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    @Test
+    void return_400_when_callback_state_is_null() {
+        Response response = resource.pluginCallback("valid-code", null, null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+
+    @Test
+    void return_403_when_state_is_not_found_in_pending_sessions() {
+        Response response = resource.pluginCallback("valid-code", "unknown-state", null, CORRELATOR);
+
+        assertThat(response.getStatus(), equalTo(403));
+    }
+
+    @Test
+    void return_403_when_session_has_expired() {
+        plantExpiredSession("valid-state", CORRELATOR);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        assertThat(response.getStatus(), equalTo(403));
+    }
+
+    @Test
+    void return_403_when_cookie_is_missing() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, null);
+
+        assertThat(response.getStatus(), equalTo(403));
+    }
+
+    @Test
+    void return_403_when_cookie_does_not_match_the_session_correlator() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, "wrong-correlator");
+
+        assertThat(response.getStatus(), equalTo(403));
+    }
+
+    @Test
+    void not_consume_the_session_when_the_cookie_check_fails() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+
+        resource.pluginCallback("valid-code", "valid-state", null, "wrong-correlator");
+
+        assertThat(resource.getPendingSessions().containsKey("valid-state"), is(true));
+    }
+
+    @Test
+    void not_consume_the_session_when_the_cookie_is_missing() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+
+        resource.pluginCallback("valid-code", "valid-state", null, null);
+
+        assertThat(resource.getPendingSessions().containsKey("valid-state"), is(true));
+    }
+
+    @Test
+    void return_503_when_oidc_authority_not_configured_on_callback() throws Exception {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        setField("oidcAuthority", Optional.of(""));
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        assertThat(response.getStatus(), equalTo(503));
+    }
+
+    @Test
+    void return_502_when_discovery_fails_on_callback() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(null);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        assertThat(response.getStatus(), equalTo(502));
+    }
+
+    @Test
+    void return_html_with_a_json_data_island_carrying_the_plugin_redirect_on_success() throws Exception {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        stubDiscovery();
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        assertThat(response.getStatus(), equalTo(200));
+        String html = (String) response.getEntity();
+        JsonNode data = extractDataIsland(html);
+        assertThat(data.get("pluginOrigin").asText(), equalTo("http://localhost:63348"));
+        assertThat(data.get("redirectPath").asText(), equalTo("/callback"));
+        assertThat(data.get("codeVerifier").asText(), equalTo("test-verifier"));
+        assertThat(data.get("code").asText(), equalTo("valid-code"));
+    }
+
+    @Test
+    void never_concatenate_an_injected_code_value_unescaped_into_the_page() throws Exception {
+        String maliciousCode = "</script><script>alert(document.domain)</script>";
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        stubDiscovery();
+
+        Response response = resource.pluginCallback(maliciousCode, "valid-state", null, CORRELATOR);
+
+        String html = (String) response.getEntity();
+        assertThat(html, not(containsString("</script><script>alert(document.domain)</script>")));
+        JsonNode data = extractDataIsland(html);
+        assertThat(data.get("code").asText(), equalTo(maliciousCode));
+    }
+
+    @Test
+    void set_a_strict_content_security_policy_cache_control_and_referrer_policy_on_the_callback_page() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        stubDiscovery();
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        String csp = (String) response.getMetadata().getFirst("Content-Security-Policy");
+        assertThat(csp, allOf(
+                containsString("script-src 'nonce-"),
+                containsString("connect-src https://login.microsoftonline.com"),
+                containsString("base-uri 'none'"),
+                containsString("form-action 'none'")));
+        assertThat(response.getMetadata().getFirst("Cache-Control"), equalTo("no-store"));
+        assertThat(response.getMetadata().getFirst("Referrer-Policy"), equalTo("no-referrer"));
+    }
+
+    @Test
+    void remove_state_from_pending_sessions_after_a_successful_callback() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        stubDiscovery();
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        assertThat(response.getStatus(), equalTo(200));
+        assertThat(resource.getPendingSessions().containsKey("valid-state"), is(false));
+    }
+
+    @Test
+    void reject_reuse_of_an_already_consumed_state() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+        stubDiscovery();
+        resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        Response second = resource.pluginCallback("valid-code", "valid-state", null, CORRELATOR);
+
+        assertThat(second.getStatus(), equalTo(403));
+    }
+
+    @Test
+    void return_an_immutable_snapshot_from_get_pending_sessions() {
+        plantSession("valid-state", "63348", "/callback", CORRELATOR);
+
+        Map<String, PluginAuthResource.PendingSession> snapshot = resource.getPendingSessions();
+
+        assertThrows(UnsupportedOperationException.class, () -> snapshot.put("injected",
+                new PluginAuthResource.PendingSession("1", "/callback", "v", null, "c",
+                        System.currentTimeMillis() + 600_000L)));
+    }
+
+    private JsonNode extractDataIsland(String html) throws Exception {
+        String marker = "id=\"calm-plugin-auth-data\">";
+        int start = html.indexOf(marker) + marker.length();
+        int end = html.indexOf("</script>", start);
+        String json = html.substring(start, end);
+        return MAPPER.readTree(json);
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestSearchResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestSearchResourceShould.java
index 23cea9348..0ac0147c0 100644
--- a/calm-hub/src/test/java/org/finos/calm/resources/TestSearchResourceShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestSearchResourceShould.java
@@ -5,7 +5,9 @@
 import io.quarkus.test.security.TestSecurity;
 import org.finos.calm.domain.search.GroupedSearchResults;
 import org.finos.calm.domain.search.SearchResult;
+import org.finos.calm.security.UserAccessValidator;
 import org.finos.calm.store.SearchStore;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -32,6 +34,18 @@ public class TestSearchResourceShould {
     @InjectMock
     SearchStore mockSearchStore;
 
+    // See the equivalent field in TestNamespaceResourceShould: @TestSecurity(authorizationEnabled
+    // = false) bypasses declarative permission checks but not SearchResource's own ReadableScope
+    // lookup, so without this the identity-less test principal resolves to zero grants instead
+    // of the unfiltered Optional.empty() these tests expect.
+    @InjectMock
+    UserAccessValidator mockUserAccessValidator;
+
+    @BeforeEach
+    void setUpUserAccessValidator() {
+        lenient().when(mockUserAccessValidator.getReadableNamespaces(any())).thenReturn(Optional.empty());
+    }
+
     static Stream<Arguments> provideInvalidQueryParameters() {
         return Stream.of(
                 Arguments.of(null, "Query parameter 'q' is required"),
diff --git a/calm-hub/src/test/java/org/finos/calm/security/TestOidcPluginAuthClientShould.java b/calm-hub/src/test/java/org/finos/calm/security/TestOidcPluginAuthClientShould.java
new file mode 100644
index 000000000..4b4dd4f77
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/security/TestOidcPluginAuthClientShould.java
@@ -0,0 +1,220 @@
+package org.finos.calm.security;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.net.InetSocketAddress;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+import static org.hamcrest.Matchers.sameInstance;
+
+class TestOidcPluginAuthClientShould {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private OidcPluginAuthClient client;
+    private HttpServer server;
+    private int serverPort;
+    private final AtomicInteger discoveryHits = new AtomicInteger();
+
+    @BeforeEach
+    void setup() throws Exception {
+        client = new OidcPluginAuthClient();
+        setField("connectTimeoutSeconds", 5);
+        setField("requestTimeoutSeconds", 5);
+        invokeInit();
+
+        // Start a local HTTP server for testing
+        server = HttpServer.create(new InetSocketAddress(0), 0);
+        serverPort = server.getAddress().getPort();
+        server.start();
+    }
+
+    @AfterEach
+    void teardown() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    private void setField(String name, Object value) throws Exception {
+        Field field = OidcPluginAuthClient.class.getDeclaredField(name);
+        field.setAccessible(true);
+        field.set(client, value);
+    }
+
+    private void invokeInit() throws Exception {
+        Method init = OidcPluginAuthClient.class.getDeclaredMethod("init");
+        init.setAccessible(true);
+        init.invoke(client);
+    }
+
+    private void serveDiscoveryDocument(ObjectNode discoveryDoc) {
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            discoveryHits.incrementAndGet();
+            byte[] body = MAPPER.writeValueAsBytes(discoveryDoc);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+    }
+
+    // --- discoverEndpoints tests ---
+
+    @Test
+    void return_endpoints_from_valid_discovery_document() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+        discoveryDoc.put("issuer", "https://idp.example.com");
+        serveDiscoveryDocument(discoveryDoc);
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.authorizationEndpoint(), equalTo("https://idp.example.com/authorize"));
+        assertThat(result.tokenEndpoint(), equalTo("https://idp.example.com/token"));
+    }
+
+    @Test
+    void return_endpoints_when_issuer_url_has_trailing_slash() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+        serveDiscoveryDocument(discoveryDoc);
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort + "/");
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.authorizationEndpoint(), equalTo("https://idp.example.com/authorize"));
+    }
+
+    @Test
+    void return_null_when_discovery_returns_non_200() {
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            exchange.sendResponseHeaders(500, -1);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_document_missing_authorization_endpoint() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+        serveDiscoveryDocument(discoveryDoc);
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_document_missing_token_endpoint() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+        serveDiscoveryDocument(discoveryDoc);
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_url_is_unreachable() {
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:1");
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_returns_invalid_json() {
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            byte[] body = "not-json".getBytes();
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    // --- discovery caching ---
+
+    @Test
+    void cache_the_discovery_document_across_calls_for_the_same_issuer() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+        serveDiscoveryDocument(discoveryDoc);
+        String issuer = "http://localhost:" + serverPort;
+
+        OidcPluginAuthClient.OidcEndpoints first = client.discoverEndpoints(issuer);
+        server.removeContext("/.well-known/openid-configuration");
+        OidcPluginAuthClient.OidcEndpoints second = client.discoverEndpoints(issuer);
+
+        assertThat(discoveryHits.get(), equalTo(1));
+        assertThat(second, sameInstance(first));
+    }
+
+    @Test
+    void refetch_discovery_when_the_issuer_changes() throws Exception {
+        ObjectNode discoveryDocA = MAPPER.createObjectNode();
+        discoveryDocA.put("authorization_endpoint", "https://a.example.com/authorize");
+        discoveryDocA.put("token_endpoint", "https://a.example.com/token");
+        serveDiscoveryDocument(discoveryDocA);
+        String issuerA = "http://localhost:" + serverPort;
+
+        client.discoverEndpoints(issuerA);
+
+        HttpServer serverB = null;
+        try {
+            serverB = HttpServer.create(new InetSocketAddress(0), 0);
+            int portB = serverB.getAddress().getPort();
+            ObjectNode discoveryDocB = MAPPER.createObjectNode();
+            discoveryDocB.put("authorization_endpoint", "https://b.example.com/authorize");
+            discoveryDocB.put("token_endpoint", "https://b.example.com/token");
+            byte[] body = MAPPER.writeValueAsBytes(discoveryDocB);
+            serverB.createContext("/.well-known/openid-configuration", exchange -> {
+                exchange.getResponseHeaders().add("Content-Type", "application/json");
+                exchange.sendResponseHeaders(200, body.length);
+                exchange.getResponseBody().write(body);
+                exchange.close();
+            });
+            serverB.start();
+
+            OidcPluginAuthClient.OidcEndpoints result = client.discoverEndpoints("http://localhost:" + portB);
+
+            assertThat(result.authorizationEndpoint(), equalTo("https://b.example.com/authorize"));
+        } finally {
+            if (serverB != null) {
+                serverB.stop(0);
+            }
+        }
+    }
+}