Task: provision an OIDC test realm/client for pkg6depotd integration tests and CI #36

New issue

Closed

opened 2026-09-19 19:59:09 +00:00 by toasterson · 1 comment

toasterson commented

2026-09-19 19:59:09 +00:00

Owner

Part of #24

Maintainer decisions — 2026-09-22

Deferred beyond v1 by the maintainer: local ingestion suffices, and CI will deliver a completed multi-package .p5p and notify an import script (#38). Authenticated REST publishing, its OIDC/RBAC decisions and provider provisioning are not v1 release gates. Preserve this ticket and its research/dependencies for later work; no later milestone was selected. Do not provision credentials or an identity provider as part of v1.

These decisions supersede conflicting earlier scope below. This update records maintainer decisions, not implementation or test completion.

Earlier brief and context

Question

Once the provider is chosen: create the realm/application, a CI service account (client credentials) and a human test user, record issuer URL, audience and JWKS URI in 1Password, and add the CI secrets to the OpenIndiana/ips repository on code.aopc.cloud. Resolve with the facts later tickets depend on (issuer, audience, scope names, secret names), not the secrets themselves.

Blocked by the provider decision.

Links

Informs #18

Part of #24 ## Maintainer decisions — 2026-09-22 Deferred beyond v1 by the maintainer: local ingestion suffices, and CI will deliver a completed multi-package .p5p and notify an import script (#38). Authenticated REST publishing, its OIDC/RBAC decisions and provider provisioning are not v1 release gates. Preserve this ticket and its research/dependencies for later work; no later milestone was selected. Do not provision credentials or an identity provider as part of v1. These decisions supersede conflicting earlier scope below. This update records maintainer decisions, not implementation or test completion. <details> <summary>Earlier brief and context</summary> ## Question Once the provider is chosen: create the realm/application, a CI service account (client credentials) and a human test user, record issuer URL, audience and JWKS URI in 1Password, and add the CI secrets to the OpenIndiana/ips repository on code.aopc.cloud. Resolve with the facts later tickets depend on (issuer, audience, scope names, secret names), not the secrets themselves. Blocked by the provider decision. ## Links - Informs #18 </details>

toasterson added this to the Release 1 (server only) milestone

2026-09-19 19:59:09 +00:00

toasterson added the

wayfinder:task

label

2026-09-19 19:59:09 +00:00

toasterson added a new dependency

2026-09-19 19:59:29 +00:00

#28 Choose the OIDC provider and token flows for CI publishers and humans

toasterson added a new dependency

2026-09-19 19:59:35 +00:00

#18 OpenID Connect support to authenticate users

toasterson referenced this issue

2026-09-19 19:59:46 +00:00

Wayfinder map: Release 1 (server only) #24

forge removed this from the Release 1 (server only) milestone

2026-09-22 12:12:59 +00:00

toasterson commented

2026-09-27 13:13:56 +00:00

Author

Owner

Closed as out of scope for Release 1 (wayfinder): the OIDC test realm only serves the deferred remote-publish work (#18, #28). Reopen when that is scheduled.

Closed as **out of scope for Release 1** (wayfinder): the OIDC test realm only serves the deferred remote-publish work (#18, #28). Reopen when that is scheduled.

toasterson closed this issue

2026-09-27 13:13:59 +00:00

toasterson referenced this issue

2026-09-27 13:14:15 +00:00

Wayfinder map: Release 1 (server only) #24