feat: sign JWTs with RS256, publish public key via JWKS - #20
Merged
Conversation
The "groups" step reuses .token, which userInfo's response sets on the shared step context; without dependsOn the two can run out of order and groups fires before .token exists.
Pinned to the krateo-platformops/plumbing@feat/rs256-jwks-keysource commit pending release; re-pin to the tagged version once krateo-platformops/plumbing#21 is merged and tagged.
authn signs access tokens with an RSA private key (RS256) instead of a shared
HMAC secret, and publishes the matching public key as a JWKS at
GET /.well-known/jwks.json (new internal/routes/jwks package). Every route
that mints a token now carries the key through as PrivateKey+KeyID instead of
a plain SigningKey string.
The private key is read from a mounted file (--jwt-sign-key-file /
JWT_SIGN_KEY_FILE), never from an env var, and authn now fails fast at startup
(before any route is registered) if the key ID or key file is missing or
unparseable — the old design failed silently per-request into a tokenless
response instead.
Chart: the Secret (authn-jwt-signing-key, key private.pem) is mounted as a
volume rather than pulled in via envFrom; jwtSignKeySecretName becomes the
jwt.{signKeySecretName,signKeySecretKey,mountPath,kid} block. Consumers that
verify authn's tokens (snowplow, etc.) get the public key from the JWKS
endpoint, not from a shared Secret — see docs/jwt-jwks.md.
…ard registry "Reference" isn't a registered OKF type (see .github/DOCS-STANDARD.md's lint-docs TYPES set); "Integration" is the closest existing fit and matches rbac.md's precedent for an extension doc. Also list the file in llms.txt alongside rbac.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /.well-known/jwks.json(newinternal/routes/jwks).--jwt-sign-key-file/JWT_SIGN_KEY_FILE), never injected as an env var, and authn now fails fast at startup if the key/kidis missing or unparseable, instead of silently omittingaccessTokenper-request.authn-jwt-signing-key(keyprivate.pem) is mounted as a volume;jwtSignKeySecretNamebecomes thejwt.{signKeySecretName,signKeySecretKey,mountPath,kid}block. Seedocs/jwt-jwks.md.testdata/oauth.yaml'sgroupsRESTAction step nowdependsOnuserInfo(it reads.token, which only exists afteruserInforuns).Cross-repo dependency
Depends on plumbing PR krateo-platformops/plumbing#21 (adds the RS256/
KeyID/JWKSjwtutilAPI this repo calls). Until that PR is merged and tagged:go.modis pinned to the plumbing PR's branch-tip commit as a pseudo-version so this branch builds and tests green today.go get github.com/krateo-platformops/plumbing@<tag> && go mod tidyto replace the pseudo-version — a squash-merge on the plumbing side would otherwise leave this pinned to a commit SHA that stops existing.Consumers that verify authn's tokens (snowplow) read the public key from the JWKS endpoint added here — see the snowplow and installer PRs for the rest of the chain.
Test plan
go build ./.../go test ./...(go/authn), green against the plumbing pseudo-version