miki3421 opened a new pull request, #61: URL: https://github.com/apache/openserverless-admin-api/pull/61
OIDC namespace mapping currently selects tenant credentials without verifying that the validated external identity owns the selected `WhiskUser`. Require exact, nonempty `iss` and `sub` values to match its SSO annotations before returning credentials. The same check covers direct-token, password-grant, and device login, including existing resources encountered during auto-provisioning or a create conflict. Recheck the binding before releasing credentials and reject orphan metadata or an existing `WhiskUser` replaced during login. Existing namespaces without SSO ownership annotations now return `403` for OIDC login. `docs/OIDC.md` explains how a cluster administrator can verify the owner and explicitly bind the namespace. Legacy OPS password authentication and the existing metadata credential format are preserved. Validation: - 54 unit tests passed against the current `0.9.0` source, including identity-binding regressions and the existing authentication and builder tests. - All `openserverless/common/*.py` doctests passed; `git diff --check` passed. - The same SSO implementation was tested on a K3s 0.9.0 baseline: 43 post-fix live checks passed, covering real Keycloak direct/password/device flows, auto-provisioning, legacy login, and unchanged Alpha/Beta applications. Based on `apache/openserverless-admin-api:0.9.0` at `2ecb071`. This PR contains only the SSO fix, its tests, and related documentation; no workflow or component-version changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
