Repository navigation

feat(security): SSO/JWT authentication migration (Phase 1) - #1569

Merged

mergify[bot] merged 70 commits into

mainfrom

jsell/spec/sso-authentication

May 28, 2026

Merged

feat(security): SSO/JWT authentication migration (Phase 1)#1569
mergify[bot] merged 70 commits into
mainfrom
jsell/spec/sso-authentication

Commits on May 12, 2026
- spec(security): add SSO authentication specification
  
  jsell-rh
  and
  claude
  committed
  629466d
- spec(security): add IAM consolidation roadmap from PR #1466
  
  jsell-rh
  and
  claude
  committed
  86ac6f9
Commits on May 13, 2026
- spec(security): add OIDC callback route coexistence and client config requirements
  
  jsell-rh
  and
  claude
  committed
  2f0f775
Commits on May 14, 2026
- spec(security): add local Keycloak dev instance requirement
  
  jsell-rh
  and
  claude
  committed
  a8e7080
- workflow(security): add local Keycloak dev setup and Identity Brokering
  
  jsell-rh
  and
  claude
  committed
  64ad5a3
- feat(security): add Keycloak dev instance, JWT validation package, and impersonation RBAC
  
  jsell-rh
  and
  claude
  committed
  296ea91
- feat(security): add backend dual-path JWT/TokenReview auth with K8s impersonation
  
  jsell-rh
  and
  claude
  committed
  a5e3647
- feat(frontend): add BFF OIDC authentication with Keycloak
  
  jsell-rh
  and
  claude
  committed
  c7ed384
- fix(security): use portless localhost redirect URI for Keycloak
  
  jsell-rh
  and
  claude
  committed
  64613fd
- fix(frontend): use standard URL for OIDC callback and match redirect_uri
  
  jsell-rh
  and
  claude
  committed
  63148f0
- fix(frontend): remap iss parameter in OIDC callback for dual-URL envs
  
  jsell-rh
  and
  claude
  committed
  a718477
- fix(security): set KC_HOSTNAME for consistent issuer across URLs
  
  jsell-rh
  and
  claude
  committed
  c7786b9
- fix(security): handle split-URL Keycloak in Kind dev environments
  
  jsell-rh
  and
  claude
  committed
  2bdb6ea
- fix(frontend): add TTL to OIDC discovery cache to prevent stale endpoints
  
  jsell-rh
  and
  claude
  committed
  c2c9820
- fix(backend): align RoleBinding subject with impersonation identity
  
  jsell-rh
  and
  claude
  committed
  77548d6
- fix(frontend): auto-retry on stale OIDC state and fix logout redirect
  
  jsell-rh
  and
  claude
  committed
  1d6706b
- fix(frontend): use runtime ssoEnabled flag for logout redirect
  
  jsell-rh
  and
  claude
  committed
  03f1815
- fix(frontend): update project layout logout to use SSO when enabled
  
  jsell-rh
  and
  claude
  committed
  a32c4ea
- feat(e2e): migrate test auth to Keycloak client_credentials
  
  jsell-rh
  and
  claude
  committed
  c403b74
- feat(frontend): add session expired dialog with global 401 detection
  
  jsell-rh
  and
  claude
  committed
  a5ce781
- fix(frontend): add refresh logging and fix middleware CORS on expiry
  
  jsell-rh
  and
  claude
  committed
  fc58207
- fix(frontend): use manual token refresh in split-URL dev environments
  
  jsell-rh
  and
  claude
  committed
  cc1d2c3
- fix(security): proxy Keycloak through frontend to eliminate split URLs
  
  jsell-rh
  and
  claude
  committed
  86c190d
- fix(security): use KC_HOSTNAME_BACKCHANNEL_DYNAMIC for consistent issuer
  
  jsell-rh
  and
  claude
  committed
  b5355cb
- docs: update dev environment docs for Keycloak SSO authentication
  
  jsell-rh
  and
  claude
  committed
  a5d843a
- docs: clarify sso-authentication is an infrastructure flag, not user-facing
  
  jsell-rh
  and
  claude
  committed
  ef5c611
- Merge branch 'main' into jsell/spec/sso-authentication
  jsell-rh
  authored
  047d324
- Merge branch 'jsell/spec/sso-authentication' of https://github.com/ambient-code/platform into jsell/spec/sso-authentication
  jsell-rh
  committed
  4e714b0
- feat: add make kind-sso-toggle to switch auth modes in Kind
  
  jsell-rh
  and
  claude
  committed
  27c0db5
- style(backend): fix gofmt formatting in SSO files
  
  jsell-rh
  and
  claude
  committed
  6864324
- fix(frontend): resolve useEffect missing dependency lint warning
  
  jsell-rh
  and
  claude
  committed
  c5eb749
- fix(backend): add package comment to jwtauth for staticcheck ST1000
  
  jsell-rh
  and
  claude
  committed
  4b7ab9f
- fix(backend): unflake 3 project handler tests and add userID fallback
  
  jsell-rh
  and
  claude
  committed
  da361b8
Commits on May 15, 2026
- fix(auth): enable dual-auth in SSO mode for E2E tests and API clients
  
  jsell-rh
  and
  claude
  committed
  03fdfb0
- fix(keycloak): add preferred_username claim to E2E client tokens
  
  jsell-rh
  and
  claude
  committed
  aa3e870
- fix(e2e): default to legacy auth in Kind, use K8s SA token for E2E
  
  jsell-rh
  and
  claude
  committed
  755d5d0
- feat(e2e): run E2E tests in both legacy and SSO auth modes
  
  jsell-rh
  and
  claude
  committed
  93dbf39
- fix(e2e): add E2E login route for SSO session cookie injection
  
  jsell-rh
  and
  claude
  committed
  b590276
- fix(e2e): fix SSO E2E by using port 80 and E2E_TEST_HELPERS guard
  
  jsell-rh
  and
  claude
  committed
  4340868
- fix: make kind-sso-toggle set SSO URLs with correct local dev port
  
  jsell-rh
  and
  claude
  committed
  096bd49
- fix: restart backend after Keycloak in kind-sso-toggle
  
  jsell-rh
  and
  claude
  committed
  622d993
Commits on May 18, 2026
- fix(frontend): SSO redirect and session cookie fixes for reverse-proxy deployments
  
  jsell-rh
  and
  claude
  committed
  66c6036
Commits on May 19, 2026
- fix(frontend): SSO logout redirects to Keycloak end-session endpoint
  
  jsell-rh
  and
  claude
  committed
  57d96b1
Commits on May 21, 2026
- feat(api-server): make JWK cert URL configurable via env var and CLI flag
  
  jsell-rh
  and
  claude
  committed
  e192e4b
- feat: add native SSO deployment workflow and hcmais overlay
  
  jsell-rh
  and
  claude
  committed
  84ac69b
- feat(backend): SSO env var bypass and impersonation fixes
  
  jsell-rh
  and
  claude
  committed
  40e52ce
- chore: move hp/ overlay to hcmais/keycloak/
  
  jsell-rh
  and
  claude
  committed
  be49c12
- fix(api-server): revert migration ID to avoid re-run on existing databases
  
  jsell-rh
  and
  claude
  committed
  56532bf
- Revert "fix(api-server): revert migration ID to avoid re-run on existing databases"
  jsell-rh
  committed
  baff4ff
- Merge branch 'main' into jsell/spec/sso-authentication
  jsell-rh
  authored
  e3c1066
- fix(api-server): add placeholder integration test to fix CI
  
  jsell-rh
  and
  claude
  committed
  500bbbe
- Merge branch 'jsell/spec/sso-authentication' of https://github.com/ambient-code/platform into jsell/spec/sso-authentication
  jsell-rh
  committed
  9209056
- fix(api-server): add project-scoped credential routes to match OpenAPI spec
  
  jsell-rh
  and
  claude
  committed
  0b7a9ad
- fix(manifests): manage CRBs outside kustomize to prevent namespace clobber
  
  jsell-rh
  and
  claude
  committed
  20c7b98
- fix: address PR review feedback
  
  jsell-rh
  and
  claude
  committed
  084e113
- fix(security): address Amber code review findings
  
  jsell-rh
  and
  claude
  committed
  1d194b0
- fix(security): address re-review — idToken, safeReturnTo dedup, CHANGE_ME
  
  jsell-rh
  and
  claude
  committed
  05bb922
- fix(manifests): exclude sso-credentials from kustomize to prevent clobber
  
  jsell-rh
  and
  claude
  committed
  235bc38
- fix(frontend): store idToken in separate cookie to avoid size limit
  
  jsell-rh
  and
  claude
  committed
  f00fbaf
- fix(frontend): fix logout redirect loop and add signed-out landing page
  
  jsell-rh
  and
  claude
  committed
  6346433
- fix(security): address third-pass review — identity precedence, groups scope, proxy hardening
  
  jsell-rh
  and
  claude
  committed
  5da471a
- fix(frontend): use Next.js Link component on logged-out page
  
  jsell-rh
  and
  claude
  committed
  f23c8bc
Commits on May 28, 2026
- chore: format
  jsell-rh
  committed
  a5f316f
- chore: normalize whitespace and formatting across codebase
  
  jsell-rh
  and
  claude
  committed
  d26188a
- fix(api-server): align project credential routes with main's subrouter pattern
  
  jsell-rh
  and
  claude
  committed
  ac697fb
- Merge branch 'main' into jsell/spec/sso-authentication
  jsell-rh
  authored
  9575817
- Merge branch 'jsell/spec/sso-authentication' of https://github.com/ambient-code/platform into jsell/spec/sso-authentication
  jsell-rh
  committed
  5f5d119
- fix(e2e): fix detached DOM race condition in Runner API Keys test
  
  jsell-rh
  and
  claude
  committed
  d1b8d5e
- fix(e2e): use input ID selector instead of panel ID for Runner API Keys test
  
  jsell-rh
  and
  claude
  committed
  2a22ba3
- fix(e2e): revert Runner API Keys test to original tolerant pattern
  
  jsell-rh
  and
  claude
  committed
  2ce3305

Commits

Commits on May 12, 2026

Commits on May 13, 2026

Commits on May 14, 2026

Commits on May 15, 2026

Commits on May 18, 2026

Commits on May 19, 2026

Commits on May 21, 2026

Commits on May 28, 2026