Repository navigation
agentplane: share operator OIDC verification under identity - #16225
Open
agentydragon wants to merge 1 commit into
Open
agentydragon wants to merge 1 commit into
agentydragon wants to merge 1 commit into
Conversation
agentydragon
added
the
proposed
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Action and MCP Edge share the same operator OIDC verification rules, but the verifier lived in Action’s handler package and returned an Action storage principal. Move verification and its Python settings schema to
agentplane/identity/operator; each service keeps its own authorization decisions. Action converts the verified issuer and subject to its own principal after verification.The issuer, audience, token profile, claim checks, JWKS cache, timeouts, status handling, and rendered configuration remain unchanged. This leaves MCP’s admission gate and Action’s private handler move for separate successor PRs. It does not choose a new privileged-workload authentication mechanism or change API wire contracts.
Validation: all five affected Go targets passed, the seven changed Python libraries built with mypy/ruff aspects, three existing settings/catalog tests passed, and changed-file hooks passed. Parent review also compared executable verifier tokens after the explicit API/type substitutions: identical.
Proposed, ready successor in native stack #16208, based on #16219. Review commit:
82954aa9ad.