Skip to content

fix(plugins): Drop mutex between token-exchange and token-broker #404

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
huang195 merged 1 commit into from
May 21, 2026
Merged

fix(plugins): Drop mutex between token-exchange and token-broker #404

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 0 additions & 39 deletions authbridge/authlib/plugins/plugins_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,42 +184,3 @@ func TestBuild_ConfigureError(t *testing.T) {
}
}

// TestBuild_TokenExchangeAndTokenBroker_ConflictingClaims exercises the
// concrete case from issue #398: configuring both token-exchange and
// token-broker on the same outbound chain is now rejected at Build
// time because they both claim ClaimAuthorizationHeader.
func TestBuild_TokenExchangeAndTokenBroker_ConflictingClaims(t *testing.T) {
// Configure both with valid per-plugin config so the
// relationship check is what fails (not some earlier Configure
// error). token-broker requires broker_url; token-exchange
// requires the keycloak_url / keycloak_realm pair.
_, err := plugins.Build([]config.PluginEntry{
{
Name: "token-exchange",
Config: []byte(`{
"keycloak_url": "http://keycloak.example",
"keycloak_realm": "test",
"default_policy": "passthrough",
"identity": {"type": "client-secret"}
}`),
},
{
Name: "token-broker",
Config: []byte(`{"broker_url": "http://broker.example"}`),
},
})
if err == nil {
t.Fatal("expected relationship conflict error for token-exchange + token-broker")
}
msg := err.Error()
for _, want := range []string{
"token-exchange",
"token-broker",
"authorization_header",
"configure only one",
} {
if !strings.Contains(msg, want) {
t.Errorf("error %q does not mention %q", err, want)
}
}
}
10 changes: 1 addition & 9 deletions authbridge/authlib/plugins/tokenbroker/plugin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ import (
"strings"

"github.com/gobwas/glob"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/contracts"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/pipeline"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins/tokenbroker/client"
Expand Down Expand Up @@ -155,14 +154,7 @@ func NewTokenBroker() *TokenBroker { return &TokenBroker{} }
func (p *TokenBroker) Name() string { return "token-broker" }

func (p *TokenBroker) Capabilities() pipeline.PluginCapabilities {
return pipeline.PluginCapabilities{
// token-broker takes exclusive ownership of the outbound
// Authorization header — same claim as token-exchange, so
// configuring both in the same outbound chain fails at
// plugins.Build rather than letting one silently clobber
// the other.
Claims: []string{contracts.ClaimAuthorizationHeader},
}
return pipeline.PluginCapabilities{}
}

func (p *TokenBroker) Configure(raw json.RawMessage) error {
Expand Down
9 changes: 1 addition & 8 deletions authbridge/authlib/plugins/tokenexchange/plugin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ import (

"github.com/kagenti/kagenti-extensions/authbridge/authlib/auth"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/config"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/contracts"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/pipeline"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins"
"github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins/tokenexchange/cache"
Expand Down Expand Up @@ -212,13 +211,7 @@ func init() {
func (p *TokenExchange) Name() string { return "token-exchange" }

func (p *TokenExchange) Capabilities() pipeline.PluginCapabilities {
return pipeline.PluginCapabilities{
// token-exchange takes exclusive ownership of the outbound
// Authorization header. Any other plugin that also claims this
// resource (e.g., token-broker) will fail at plugins.Build
// time rather than silently clobbering our replaced token.
Claims: []string{contracts.ClaimAuthorizationHeader},
}
return pipeline.PluginCapabilities{}
}

func (p *TokenExchange) Configure(raw json.RawMessage) error {
Expand Down
Loading