Skip to Content
TestingApp Authentication Preview

App Authentication Preview

OpenFactory hat owner-scoped management API für attaching OIDC-shaped authentication configuration to app. API, record shape, secret rotation flow und environment-publication path exist.

Kein Identity Provider: current adapter ist stub. Fabricates realm, client, secret, issuer URL und JWKS URL under stub-auth.apps.openfactory.tech; those endpoints issue or validate real tokens nicht. Use this feature nicht to protect app or user data.

What is implemented

  • enable_app_auth creates app auth record und generated client secret.
  • get_app_auth_status returns binding without secret.
  • rotate_app_auth_secret creates replacement secret.
  • disable_app_auth disables binding und can mark stub pool for purge.
  • When producer credential configured, OF_AUTH_ISSUER, OF_AUTH_CLIENT_ID, OF_AUTH_CLIENT_SECRET und OF_AUTH_JWKS_URL published to encrypted app environment.
  • REST und MCP operations scoped to app owner.

Controls useful für integration work against future contract. Make sign-in functional today nicht.

Safe use during preview

Surface only in disposable development environment:

enable_app_auth(app_id="<app-id>", providers=["password"])
get_app_auth_status(app_id="<app-id>")

Before treating result as active authentication, require independent evidence all following real und reachable:

  • issuer publishes valid OIDC discovery metadata;
  • JWKS endpoint exposes signing key used for issued tokens;
  • actual login flow produces token for this app;
  • app validates issuer, audience, signature und expiry; und
  • cross-app und cross-tenant tokens rejected.

Stub adapter satisfies none of those runtime requirements.

Secret handling

Generated client secret intentionally absent from app record und status response. If environment publication succeeds, stored through app environment service. Avoid logging responses from enable or rotation calls, because may return new secret once.

Disabling auth removes four OF_AUTH_* environment keys nicht automatically. Delete those values separately before redeploying app that no longer uses binding.

What remains

  • choose und deploy real OIDC provider;
  • replace stub adapter und provision service route;
  • verify tenant isolation und rotation behavior;
  • build app-auth und user-management UI; und
  • add framework integrations und production end-to-end tests.

Until items complete, integrate application with identity provider you operate und have independently validated.

Verwandt

Testing und Application VerificationCheckpoints and Rollback Preview