Skip to Content
TestingАвтентифікація застосунків (preview)

Автентифікація застосунків (preview)

OpenFactory має owner-scoped management API для attaching OIDC-shaped authentication configuration to app. API, record shape, secret rotation flow, environment-publication path exist.

Not an identity provider: current adapter is stub. It fabricates realm, client, secret, issuer URL, JWKS URL under stub-auth.apps.openfactory.tech; those endpoints do not issue or validate real tokens. Do not use this feature to protect app or user data.

What is implemented

  • enable_app_auth creates app auth record and generated client secret.
  • get_app_auth_status returns binding without returning secret.
  • rotate_app_auth_secret creates replacement secret.
  • disable_app_auth disables binding and can mark stub pool for purge.
  • When producer credential configured, OF_AUTH_ISSUER, OF_AUTH_CLIENT_ID, OF_AUTH_CLIENT_SECRET, OF_AUTH_JWKS_URL published to encrypted app environment.
  • REST and MCP operations scoped to app owner.

These controls useful for integration work against future contract. They do not make sign-in functional today.

Safe use during preview

Use surface only in disposable development environment:

enable_app_auth(app_id="<app-id>", providers=["password"])
get_app_auth_status(app_id="<app-id>")

Before treating result as active authentication, require independent evidence all following real and reachable:

  • issuer publishes valid OIDC discovery metadata;
  • JWKS endpoint exposes signing key used for issued tokens;
  • actual login flow produces token for this app;
  • app validates issuer, audience, signature, expiry; and
  • cross-app and cross-tenant tokens rejected.

Stub adapter satisfies none of those runtime requirements.

Secret handling

Generated client secret intentionally absent from app record and status response. If environment publication succeeds, stored through app environment service. Avoid logging responses from enable or rotation calls, because those calls may return new secret once.

Disabling auth does not automatically remove four OF_AUTH_* environment keys. Delete those values separately before redeploying app that no longer uses binding.

What remains

  • choose and deploy real OIDC provider;
  • replace stub adapter and provision service route;
  • verify tenant isolation and rotation behavior;
  • build app-auth and user-management UI; and
  • add framework integrations and production end-to-end tests.

Until those items complete, integrate application with identity provider you operate and independently validated.

Тестування та верифікація застосунківCheckpoints і rollback (preview)