Wire OIDC transport flags into thv run auth middleware config - #6529
Open
7487 wants to merge 1 commit into
Open
Conversation
…eware config createOIDCConfig builds the TokenValidatorConfig that WithMiddlewareFromFlags serializes into the auth middleware config, which is what the proxy uses at runtime to build the token validator. It only set AllowPrivateIP, so --thv-ca-bundle, --jwks-auth-token-file and --oidc-insecure-allow-http reached the deprecated top-level RunConfig.OIDCConfig via WithOIDCConfig but never the validator, and thv run could not talk to a local HTTP or private-CA issuer. Pass the three flags through setupOIDCConfiguration into createOIDCConfig, mirroring what stacklok#1470 did for AllowPrivateIP, and add a regression test that checks the auth middleware parameters carry them. Fixes stacklok#6522 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: 7487 <1042653432@qq.com>
7487
requested review from
ChrisJBurns,
JAORMX,
amirejaz,
aponcedeleonch,
jhrozek,
rdimitrov and
reyortiz3
as code owners
September 7, 2026 18:22
7487
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
thv runaccepts--thv-ca-bundle,--jwks-auth-token-fileand--oidc-insecure-allow-http, but none of them reach the token validator. The CLI builds the OIDC config twice:WithOIDCConfigfills the deprecated top-levelRunConfig.OIDCConfigwith every field, whilesetupOIDCConfiguration→createOIDCConfigbuilds theTokenValidatorConfigthatWithMiddlewareFromFlagsserializes into the auth middleware config. That second struct only carriedAllowPrivateIP(wired in #1470), so at runtimeauth.CreateMiddlewareunmarshalsInsecureAllowHTTP: false/CACertPath: ""/AuthTokenFile: ""and OIDC discovery against a local HTTP or private-CA issuer fails with a 401.runFlags.ThvCABundle,runFlags.JWKSAuthTokenFileandrunFlags.InsecureAllowHTTPthroughsetupOIDCConfigurationintocreateOIDCConfig, and set the correspondingTokenValidatorConfigfields there (same shape as Pass allowPrivateIP into createOIDCConfig #1470).TestSetupOIDCConfiguration_MiddlewareFlagWiring, which runs the flags throughsetupOIDCConfigurationandbuildRunnerConfigand asserts the serialized auth middleware parameters carry all four transport fields. It fails onmainfor the three fields this PR wires.Fixes #6522
Type of change
Test plan
go test ./cmd/thv/app/)task test-e2e)golangci-lint run ./cmd/thv/app/...,go vet)Does this introduce a user-facing change?
Yes.
thv run --thv-ca-bundle,--jwks-auth-token-fileand--oidc-insecure-allow-httpnow take effect for the request-time token validator, so a local HTTP issuer or an issuer with a private CA can be used forthv runas documented.🤖 Generated with Claude Code