Choose the OIDC provider and token flows for CI publishers and humans #28

New issue

Closed

opened 2026-09-19 19:58:51 +00:00 by toasterson · 1 comment

toasterson commented

2026-09-19 19:58:51 +00:00

Owner

Part of #24

Maintainer decisions — 2026-09-22

Deferred beyond v1 by the maintainer: local ingestion suffices, and CI will deliver a completed multi-package .p5p and notify an import script (#38). Authenticated REST publishing, its OIDC/RBAC decisions and provider provisioning are not v1 release gates. Preserve this ticket and its research/dependencies for later work; no later milestone was selected. Do not provision credentials or an identity provider as part of v1.

These decisions supersede conflicting earlier scope below. This update records maintainer decisions, not implementation or test completion.

Earlier brief and context

Question

Which identity provider issues the JWTs pkg6depotd validates, and how do the two kinds of callers get tokens?

Grill on:

Provider: the project's Forgejo (code.aopc.cloud is an OAuth2/OIDC provider), a dedicated Keycloak/Authentik/Zitadel realm, or provider-agnostic with a documented reference setup. What does OpenIndiana infrastructure already run?
CI publishers: client-credentials grant (service accounts), Forgejo Actions ID tokens, or long-lived PATs exchanged for JWTs? How does Solstice CI inject the secret?
Humans: device-code flow in a CLI, or browser login only? Does pkg6repo need a login verb?
Token shape: audience value, scope names (ips:read, ips:write, ips:admin?), which custom claims carry roles or publishers; JWKS rotation expectations.
Test strategy: a mock issuer in integration tests (see pkg6depotd/tests/auth_tests.rs) plus one real provider in CI.

Waits on the research ticket surveying candidate providers. Record as an ADR; the resolution should let /to-tickets slice #18 and unblocks the RBAC decision.

Links

Informs #18

Part of #24 ## Maintainer decisions — 2026-09-22 Deferred beyond v1 by the maintainer: local ingestion suffices, and CI will deliver a completed multi-package .p5p and notify an import script (#38). Authenticated REST publishing, its OIDC/RBAC decisions and provider provisioning are not v1 release gates. Preserve this ticket and its research/dependencies for later work; no later milestone was selected. Do not provision credentials or an identity provider as part of v1. These decisions supersede conflicting earlier scope below. This update records maintainer decisions, not implementation or test completion. <details> <summary>Earlier brief and context</summary> ## Question Which identity provider issues the JWTs pkg6depotd validates, and how do the two kinds of callers get tokens? Grill on: - Provider: the project's Forgejo (`code.aopc.cloud` is an OAuth2/OIDC provider), a dedicated Keycloak/Authentik/Zitadel realm, or provider-agnostic with a documented reference setup. What does OpenIndiana infrastructure already run? - CI publishers: client-credentials grant (service accounts), Forgejo Actions ID tokens, or long-lived PATs exchanged for JWTs? How does Solstice CI inject the secret? - Humans: device-code flow in a CLI, or browser login only? Does `pkg6repo` need a `login` verb? - Token shape: audience value, scope names (`ips:read`, `ips:write`, `ips:admin`?), which custom claims carry roles or publishers; JWKS rotation expectations. - Test strategy: a mock issuer in integration tests (see `pkg6depotd/tests/auth_tests.rs`) plus one real provider in CI. Waits on the research ticket surveying candidate providers. Record as an ADR; the resolution should let `/to-tickets` slice #18 and unblocks the RBAC decision. ## Links - Informs #18 </details>

toasterson added this to the Release 1 (server only) milestone

2026-09-19 19:58:51 +00:00

toasterson added the

wayfinder:grilling

label

2026-09-19 19:58:51 +00:00