Skip to Content
TestingApp authentication preview

App authentication preview

OpenFactory has an owner-scoped management API for attaching an OIDC-shaped authentication configuration to an app. The API, record shape, secret rotation flow, and environment-publication path exist.

Not an identity provider: the current adapter is a stub. It fabricates a realm, client, secret, issuer URL, and JWKS URL under stub-auth.apps.openfactory.tech; those endpoints do not issue or validate real tokens. Do not use this feature to protect an app or user data.

What is implemented

  • enable_app_auth creates the app’s auth record and a generated client secret.
  • get_app_auth_status returns the binding without returning the secret.
  • rotate_app_auth_secret creates a replacement secret.
  • disable_app_auth disables the binding and can mark a stub pool for purge.
  • When the producer credential is configured, OF_AUTH_ISSUER, OF_AUTH_CLIENT_ID, OF_AUTH_CLIENT_SECRET, and OF_AUTH_JWKS_URL are published to the encrypted app environment.
  • REST and MCP operations are scoped to the app owner.

These controls are useful for integration work against the future contract. They do not make sign-in functional today.

Safe use during preview

Use the surface only in a disposable development environment:

enable_app_auth(app_id="<app-id>", providers=["password"])
get_app_auth_status(app_id="<app-id>")

Before treating the result as active authentication, require independent evidence that all of the following are real and reachable:

  • the issuer publishes valid OIDC discovery metadata;
  • the JWKS endpoint exposes the signing key used for issued tokens;
  • an actual login flow produces a token for this app;
  • the app validates issuer, audience, signature, and expiry; and
  • cross-app and cross-tenant tokens are rejected.

The stub adapter satisfies none of those runtime requirements.

Secret handling

The generated client secret is intentionally absent from the app record and status response. If environment publication succeeds, it is stored through the app environment service. Avoid logging responses from enable or rotation calls, because those calls may return the new secret once.

Disabling auth does not automatically remove the four OF_AUTH_* environment keys. Delete those values separately before redeploying an app that no longer uses the binding.

What remains

  • choose and deploy a real OIDC provider;
  • replace the stub adapter and provision its service route;
  • verify tenant isolation and rotation behavior;
  • build the app-auth and user-management UI; and
  • add framework integrations and production end-to-end tests.

Until those items are complete, integrate your application with an identity provider you operate and have independently validated.

Testing and application verificationCheckpoints and rollback preview