Repository navigation
E2E verifies injected actor JWTs against the key set ate-idp-server serves - #2606
Open
Max Thompson (thompsonmax) wants to merge 1 commit into
Open
Max Thompson (thompsonmax) wants to merge 1 commit into
Max Thompson (thompsonmax) wants to merge 1 commit into
Conversation
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-oidc-e2e
branch
from
October 14, 2026 16:19
5a16053 to
89ee4de
Compare
2 tasks
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-oidc-e2e
branch
4 times, most recently
from
October 16, 2026 17:50
d1b1773 to
757fb18
Compare
Max Thompson (thompsonmax)
requested review from
Shruti Nair (SHRUTI6991) and
Taahir Ahmed (ahmedtd)
October 16, 2026 18:15
Max Thompson (thompsonmax)
marked this pull request as ready for review
October 16, 2026 18:16
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-oidc-e2e
branch
3 times, most recently
from
October 19, 2026 16:08
77d46c3 to
1399911
Compare
Max Thompson (thompsonmax)
changed the title
Bowei Du (bowei)
added
area/identity
area/network
area/tests
jiayimeow
pushed a commit
to jiayimeow/substrate
that referenced
this pull request
Oct 19, 2026
…#2256) Part of agent-substrate#1660. - The `egresscredinject` suite's echo-origin rules, http and https, now also replace `X-Actor-Token` with an actor JWT. The test decodes the token the in-cluster echo server sends back and checks `sub`, `aud`, the lifetime (`exp - iat`) and the `actor.ate.dev` claim, including the actor's UID. It also fails if the token is the `worker-for-actor` kind. - A fetch without the header must reach the echo server without `X-Actor-Token`, matching the existing check for `Authorization`. - `assertEchoedAuthorization` is now `assertEchoedHeaders`, so one fetch checks both headers. The test doesn't check the JWT's signature. That needs the published key set, which the OIDC discovery e2e (agent-substrate#2606) covers. Testing: lint and vet pass. The previous head passed e2e in CI on both sandbox classes; this rebase only changes an import path for the module rename. - [ ] Tests pass - [ ] Appropriate changes to documentation are included in the PR (the user guide is agent-substrate#2596)
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-oidc-e2e
branch
from
October 19, 2026 22:40
1399911 to
87dbde9
Compare
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-oidc-e2e
branch
2 times, most recently
from
October 27, 2026 17:22
2d80a01 to
b3bdbe6
Compare
…rves The egresscredinject suite checked the claims of the actor JWT the egress gateway injects, but not its signature. It now verifies the token the way a relying party does, with the key set discovered from the token's iss. ate-idp-server serves that key set, and the suite reaches it through a port-forward that checks the server's service-DNS certificate. The test verifies an injected token rather than minting its own, because with authorization enforced only the egress gateway may call MintActorJwt. Signed-off-by: Max Thompson <[email protected]>
Max Thompson (thompsonmax)
force-pushed
the
actor-jwt-oidc-e2e
branch
from
November 2, 2026 17:29
b3bdbe6 to
2e04b90
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1756.
iss, fetches the discovery document and key set from ate-idp-server, and checks the signature, issuer and audience withoidcjwt, the verifier ate-api-server uses. With E2E checks the actor JWTs the egress gateway injects #2256, now on main, that covers the whole path: the gateway mints and injects the token, and a relying party can verify it against the published keys.e2e.IDPHTTPClientreaches ate-idp-server through a port-forward to theidpService and checks its certificate against the service-DNS trust bundle.MintActorJwt, so the test verifies an injected token instead.For reviewers: the issuer comes from the token's
iss, not from install config, so the test also checks that ate-idp-server serves the issuer ate-api-server signs with.Testing: unit tests, lint and both e2e jobs pass in CI on this head, and the e2e suite verifies the injected token on gVisor and micro-VM. CI's pool is ES256, so RS256 isn't covered.
AI use: AI-assisted draft, reviewed by me.