fix(auth): accept Bearer JWT in /api/auth/sync#2
Closed
jezekra1 wants to merge 10 commits intokagenti/generic-oauthfrom
Closed
fix(auth): accept Bearer JWT in /api/auth/sync#2jezekra1 wants to merge 10 commits intokagenti/generic-oauthfrom
jezekra1 wants to merge 10 commits intokagenti/generic-oauthfrom
Conversation
Replace the hardcoded Google OAuth provider with a generic OIDC provider that works with Keycloak, Okta, Auth0, or any OIDC-compliant identity provider. Google OAuth credentials are preserved for Workspace app connections (Gmail, Calendar, etc.) which are unaffected. New env vars: OAUTH_ISSUER, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET
Make the gateway accept OIDC access tokens (Bearer JWT validated against the provider's JWKS) in addition to the existing NextAuth session cookies and API keys. Auth methods are tried in order: oc_ API key, OIDC Bearer JWT, NextAuth cookie. JWKS is optional — enabled when OAUTH_ISSUER is set.
…te conflict The custom session-sync endpoint was shadowing NextAuth's built-in /api/auth/session, preventing SessionProvider from detecting the logged-in session after OIDC callback — causing the login page to get stuck instead of redirecting to /overview.
Validates the aud claim against OAUTH_AUDIENCE when verifying JWT access tokens via JWKS. Required when OAUTH_ISSUER is set.
Infrastructure cannot reach OAUTH_ISSUER for discovery, so allow fetching JWKS keys directly via an explicit URL for both web and gateway. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add OAUTH_AUTHORIZATION_URL, OAUTH_TOKEN_URL, OAUTH_USERINFO_URL env vars so all OIDC endpoints can be specified directly, allowing the web app to skip unreachable OIDC discovery entirely.
API routes now accept OIDC access tokens via Authorization: Bearer header, matching the gateway's auth flow. Precedence: API key → OAuth JWT → session.
The sync endpoint only accepted NextAuth session cookies. When called by an external API server via Keycloak token exchange (Bearer JWT), getServerSession() returned null → 401 → user never provisioned. - Add resolveJwtUserInfo() to validate-jwt.ts: verifies JWT signature and extracts identity claims (sub, email, name) without requiring the user to already exist in the database. - Sync endpoint now tries session auth first, then falls back to JWT, so both browser logins and API-to-API sync calls work. Signed-off-by: Radek Ježek <pc.jezek@gmail.com> Signed-off-by: Radek Ježek <radek.jezek@ibm.com>
Author
|
Already fixed in 157ed12 on kagenti/generic-oauth. |
github-project-automation
bot
moved this from Backlog
to Done
in Kagenti Issue Prioritization
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api/auth/syncendpoint only accepted NextAuth session cookies, but the Humr API server calls it with a Bearer JWT (via Keycloak token exchange).getServerSession()returned null → 401 → user never provisioned in OneCLI.resolveJwtUserInfo()tovalidate-jwt.ts: verifies JWT and extracts identity claims (sub,email,name) without requiring the user to already exist in the DB.Impact
Without this fix, users authenticated via an external OIDC provider are never created in OneCLI's database, causing all downstream API calls (secrets, MCP connections, Anthropic API key) to fail with 401.
Test plan