Oauth support client id and secret by raboof · Pull Request #107 · apache/infrastructure-asfquart

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-06-10T09:28:27Z

The initial motivation to support this was to support authentication against a local test oauth server instead of the deployed server.

This might also be usable to authenticate against Authentik directly instead of going via oauth.apache.org . That possibly provides the oauth_data information in a different format, though, so that might need some massaging either here or in the configuration.

Draft but interested in feedback on the general idea/approach!

sbp · 2026-06-11T18:26:05Z

+ token = await rv.json()
+ jwks_client = PyJWKClient(OAUTH_URL_JWKS)
+ id_token = token["id_token"]
+ signing_key = jwks_client.get_signing_key_from_jwt(id_token)


Pretty sure that get_signing_key_from_jwt is blocking (synchronous), but this is an async function.

sbp · 2026-06-11T18:31:48Z

 # someplace else. This counts as a samesite request.
 return quart.Response(
 status=200,
 response=f"Successfully logged in! Welcome, {oauth_data['uid']}\n",


I don't think this would work in the new mode because OAuth 2.0 uses sub:
sub
REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII [RFC20] characters in length. The sub value is a case-sensitive string.
Maybe we could have a test or two to ensure that it works?

for local testing

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof · 2026-08-20T09:30:34Z

Thanks for the feedback here and on slack. Made some updates and tested with apache/security-dash#6 , ready for another round of review.

sbp · 2026-08-20T14:42:36Z

- self.mfa = raw_data.get("mfa", False)
- self.isRole = raw_data.get("roleaccount", False)
- self.metadata = raw_data.get("metadata", {}) # This can contain whatever specific metadata the app needs
+ if "sub" in raw_data:


In this branch, several properties (isChair, isRole, dn, metadata) aren't set, but auth.py:42 reads client_session.isChair, for example, and auth.py:60 reads client_session.isRole, so this will crash if they are used, e.g. through @require(Requirements.chair) or Requirements.roleaccount. The consequence would be a 500 due to the AttributeError.

Yes, that's semi-intentional: AFAICT the OAuth profile data currently doesn't give us a way to tell whether this is a chair or role account, so AttributeError seems like it'd be preferable to making an assumption here. For reference, for me it looks like:
{ "iss": "https://mfa-dev.apache.org/application/o/local_testing-apache-org/", "sub": "5d96dad49cb7590a117ef6de7f2506279802a87433ee34d1aa29c76db69e9a5b", "aud": "local_testing.apache.org", "exp": 1787239136, "iat": 1787238536, "auth_time": 1787125488, "acr": "goauthentik.io/providers/oauth2/default", "amr": [ "mfa" ], "sid": "e4754b0ffc4191ccaa0f95e0242eaf4f5e4a04eb273a452d35534254590db816", "email": "engelen@apache.org", "email_verified": false, "name": "Arnout Engelen", "given_name": "Arnout Engelen", "preferred_username": "engelen", "nickname": "engelen", "groups": [ "infrastructure-root", "committers", "pekko", "commons", "security", "infrastructure", "member-meta", "infrastructure-logging", "geode", "infrastructure-team", "commons-pmc", "security-pmc", "pekko-pmc", "incubator" ] }

When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

This allows using 'official' OAuth2/OIDC rather than the ASF dialect, and enables more detailed logging from mfa.apache.org requires apache/infrastructure-asfquart#107

raboof force-pushed the oauth-support-client-id-and-secret branch from d4e3a95 to 12ef88cCompare June 11, 2026 13:01

raboof marked this pull request as draft June 11, 2026 13:08

sbp reviewed Jun 11, 2026
View reviewed changes

raboof force-pushed the oauth-support-client-id-and-secret branch 2 times, most recently from 5c42e65 to 2acd3eeCompare July 23, 2026 07:40

oauth2: allow disabling https enforcement
c779a7e
for local testing

raboof force-pushed the oauth-support-client-id-and-secret branch 8 times, most recently from 5377085 to 0366feaCompare August 5, 2026 15:07

raboof force-pushed the oauth-support-client-id-and-secret branch 7 times, most recently from e66e09a to 9f0e633Compare August 20, 2026 09:12

raboof mentioned this pull request Aug 20, 2026
feat: log in with OAuth 2.0 / OIDC apache/security-dash#6
Draft

raboof force-pushed the oauth-support-client-id-and-secret branch from 9f0e633 to 10ed333Compare August 20, 2026 09:27

raboof marked this pull request as ready for review August 20, 2026 09:30

sbp requested changes Aug 20, 2026
View reviewed changes

raboof added 2 commits August 20, 2026 17:47

feat: fuller OAuth2 implementation
fd0f1ed
When CLIENT_ID is populated, use the stricter OAuth2 implementation to authenticate directly to https://mfa.apache.org

update uv.lock
9f802d3

raboof force-pushed the oauth-support-client-id-and-secret branch from 10ed333 to 9f802d3Compare August 20, 2026 15:47

raboof requested a review from sbp August 22, 2026 09:02