Skip to content

Add a consent model for external OIDC subject tokens #6149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jhrozek merged 8 commits into from
Aug 7, 2026
Merged

Add a consent model for external OIDC subject tokens #6149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f6fb153
Accept subject tokens from trusted external OIDC issuers
jhrozek Aug 6, 2026
54f5b17
Correct documentation drift and error reporting
jhrozek Aug 6, 2026
185c06e
Fix the log-capture race and restore discovery coverage
jhrozek Aug 6, 2026
8719177
Isolate trusted issuers and qualify external subjects
jhrozek Aug 6, 2026
e5f4a86
Require an explicit delegate-client binding per issuer
jhrozek Aug 6, 2026
4d9c3e1
Extract per-issuer setup and prune comments
jhrozek Aug 6, 2026
b26cf50
Reword two terms flagged by codespell
jhrozek Aug 7, 2026
53cc549
Regenerate swagger after pruning doc comments
jhrozek Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
257 changes: 257 additions & 0 deletions docs/arch/17-token-exchange-delegation.md
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 6 additions & 0 deletions docs/arch/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,12 @@ Welcome to the ToolHive architecture documentation. This directory contains comp
- Composite-workflow suspend/resume as the sole durable-state trigger (RFC-0083 D5 handles, owner binding, TTL)
- Sampling's deprecated-pass-through-only disposition (SEP-2577) and the go-sdk/mcpcompat gap list

17. **[External Subject-Token Exchange (Delegation)](17-token-exchange-delegation.md)**
- `trustedIssuers`: accepting subject tokens from an external OIDC issuer during RFC 8693 token exchange
- Confused-deputy trust model and the `may_act` / allowlist consent signals
- Accepted limitations: client-set equivalence, disjoint subject namespaces, partial provenance
- Operational gotchas: audience/scope binding, discovery redirects, JWKS caching, diagnostics

### Existing Documentation

For middleware architecture, see: **[docs/middleware.md](../middleware.md)**
Expand Down
53 changes: 53 additions & 0 deletions docs/server/docs.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

53 changes: 53 additions & 0 deletions docs/server/swagger.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

91 changes: 91 additions & 0 deletions docs/server/swagger.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading