stacklok / toolhive / 21634646725

61%

Build Type

push

github

Committed by web-flow

Commit Message

Add OIDC provider upstream support to authserver (#3562)

Implements OIDC provider support for upstream identity providers like
Google, Microsoft/Entra, Okta, and Auth0.

Benefits for users:

1. Simpler configuration - just specify the issuer URL instead of
   individual endpoints:

```
   # Before (OAuth2 - must look up each endpoint URL):
   upstream:
     type: oauth2
     client_id: "..."
     authorization_endpoint: "https://accounts.google.com/o/oauth2/v2/auth"
     token_endpoint: "https://oauth2.googleapis.com/token"
     userinfo_endpoint: "https://openidconnect.googleapis.com/v1/userinfo"

   # After (OIDC - endpoints auto-discovered):
   upstream:
     type: oidc
     client_id: "..."
     issuer: "https://accounts.google.com"
```

2. Cryptographic identity verification - ID tokens are signed JWTs
   validated locally, no extra network call to UserInfo endpoint.

3. Replay attack protection via nonce validation.

Implementation uses go-oidc library for discovery and delegates issuer
validation to it. Additional security checks validate HTTPS enforcement
for non-localhost endpoints and required field presence. ID token
validation is stubbed for a follow-up PR.

Run Details

151 of 172 new or added lines in 1 file covered. (87.79%)

35 existing lines in 4 files now uncovered.

40028 of 66031 relevant lines covered (60.62%)

75.29 hits per line