mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 12:03:59 +00:00
93157b0a86
Completes the Phase 2 OIDC laptop dev path. Source for the OIDC surface
(discovery, authorize, token, userinfo, JWKS controllers + signing /
session services) landed on `main` via the merge that brought
claude/crazy-bose-fec256 back. This commit makes Phase 2 actually
exercisable in the k3d dev loop without any GKE deploy.
What's new:
authority/src/main/resources/application-k3d.yml
Spring profile activated by `-Dspring-boot.run.profiles=k3d`.
Enables OIDC (knoe.oidc.enabled=true), points the issuer at
`http://localhost:8080`, sets Kerberos realm to KNOE.LOCAL, and
aligns the datasource with the port-forwarded localhost:5432 DB.
etc/gen_oidc_signing_key.sh (executable)
Idempotent RS256 PKCS#8 keypair generator. Outputs:
etc/secrets/knoe-auth-oidc-key.pem (PEM)
etc/secrets/knoe-auth-oidc-key.b64 (single-line base64 of DER —
directly consumable as KNOE_AUTH_OIDC_SIGNING_KEY by
OidcTokenService.init())
`etc/secrets/` is already gitignored. Set FORCE=1 to rotate.
What's wired:
scripts/k3d-knoe-up.sh
New §7 calls etc/gen_oidc_signing_key.sh after schema seed. Keypair
persists across `make k3d-knoe-down && make k3d-knoe-up` cycles.
scripts/k3d-knoe-pf.sh
Output now includes the KNOE_AUTH_OIDC_SIGNING_KEY export line, the
full `mvn spring-boot:run` invocation with -Dspring-boot.run.profiles=k3d,
and the three OIDC endpoints to curl-test.
What's documented:
docs/local-dev-knoe-auth.md
"Daily loop" Terminal B: now exports KNOE_AUTH_OIDC_SIGNING_KEY,
runs with `-Dspring-boot.run.profiles=k3d`, and the verify section
includes /jwks.json. IntelliJ run config: adds Active Profiles: k3d
and a note about pasting the b64 directly (no shell expansion in
the env-var field).
docs/knoe-system.md
Phase 2 status row split: "k3d setup" → Shipped, "GKE deploy" →
Pending. The "Open work items" Phase 2 entry rewritten to flag
that the GKE deploy is the remaining thread (gated on queue #3 for
the image rebuild as `knoe-auth:latest`).
docs/TODO.md
Promoted "Phase 2 OIDC provider — GKE deploy" into §In progress
(replacing the empty "(none)" placeholder). Done section updated
with two entries: the k3d Phase 1 dev loop (Junie's c3...) and
this Phase 2 OIDC k3d sandbox.
End-to-end loop the engineer can run:
make k3d-knoe-up # one-time, ~5 min
make k3d-knoe-pf & # port-forwards
export KRB5_CONFIG=$PWD/etc/krb5.local.conf
export KNOE_AUTH_OIDC_SIGNING_KEY=$(cat etc/secrets/knoe-auth-oidc-key.b64)
mvn -pl authority spring-boot:run \
-Dspring-boot.run.jvmArguments="-Djava.security.krb5.conf=$PWD/etc/krb5.local.conf" \
-Dspring-boot.run.profiles=k3d
# then:
curl -s http://localhost:8080/.well-known/openid-configuration | jq .issuer
# → "http://localhost:8080"
curl -s http://localhost:8080/jwks.json | jq '.keys[0].kty'
# → "RSA"
Verified locally: keypair generator round-trips through openssl pkey -inform DER
(produces valid 2048-bit RSA keys); idempotent (existing key kept by default,
FORCE=1 rotates); bash -n clean on all 5 touched scripts.
Out of scope (TODO §In progress captures it):
- GKE deploy of Phase 2 (image rebuild + K8s Secret + deployment env vars)
- SPNEGO E2E from host browsers (k3d-mirror Phase 2)
- knoe-auth-as-pod in k3d (k3d-mirror Phase 3)
- OidcCodeService DB persistence (separate track)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
2.5 KiB
Bash
Executable File
66 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gen_oidc_signing_key.sh
|
|
#
|
|
# Idempotent RS256 keypair generator for knoe-auth Phase 2 OIDC provider
|
|
# in local k3d / TDD dev mode. Produces:
|
|
#
|
|
# etc/secrets/knoe-auth-oidc-key.pem PKCS#8 PEM of the private key
|
|
# etc/secrets/knoe-auth-oidc-key.b64 single-line base64 of the same key,
|
|
# suitable for KNOE_AUTH_OIDC_SIGNING_KEY
|
|
#
|
|
# Both files live under etc/secrets/ which is gitignored. If the .b64 file
|
|
# already exists, the script is a no-op (so you keep stable token signatures
|
|
# across restarts).
|
|
#
|
|
# Usage:
|
|
# bash etc/gen_oidc_signing_key.sh # generate if missing
|
|
# FORCE=1 bash etc/gen_oidc_signing_key.sh # rotate
|
|
#
|
|
# Env consumption (in your shell or the spring-boot:run command):
|
|
# export KNOE_AUTH_OIDC_SIGNING_KEY=$(cat etc/secrets/knoe-auth-oidc-key.b64)
|
|
#
|
|
# Production (GKE) provides this via a K8s Secret + Workload Identity / OpenBao;
|
|
# this script is for laptop dev only.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
SECRETS_DIR="${REPO_ROOT}/etc/secrets"
|
|
PEM_PATH="${SECRETS_DIR}/knoe-auth-oidc-key.pem"
|
|
B64_PATH="${SECRETS_DIR}/knoe-auth-oidc-key.b64"
|
|
|
|
mkdir -p "${SECRETS_DIR}"
|
|
chmod 700 "${SECRETS_DIR}" 2>/dev/null || true
|
|
|
|
if [[ -f "${B64_PATH}" && "${FORCE:-0}" != "1" ]]; then
|
|
echo "[gen_oidc_signing_key] already present at ${B64_PATH} — keeping. Pass FORCE=1 to rotate."
|
|
exit 0
|
|
fi
|
|
|
|
if ! command -v openssl >/dev/null 2>&1; then
|
|
echo "[gen_oidc_signing_key] ERROR: openssl not found on PATH." >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "[gen_oidc_signing_key] generating RSA-2048 PKCS#8 keypair ..."
|
|
# `openssl genpkey` writes a PEM-wrapped PKCS#8 private key. Spring's
|
|
# OidcTokenService.init() reads KNOE_AUTH_OIDC_SIGNING_KEY as base64 of the
|
|
# raw DER PKCS#8 bytes — i.e., the PEM with header/footer stripped and no
|
|
# whitespace. We produce both forms.
|
|
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
|
|
-out "${PEM_PATH}" 2>/dev/null
|
|
chmod 600 "${PEM_PATH}"
|
|
|
|
# Strip PEM headers/footers and newlines to get the single-line base64 of the
|
|
# DER PKCS#8 bytes that the Java `Base64.getDecoder().decode(signingKey)` call
|
|
# expects (per OidcTokenService.java).
|
|
grep -v -- '-----' "${PEM_PATH}" | tr -d '\n' > "${B64_PATH}"
|
|
chmod 600 "${B64_PATH}"
|
|
|
|
echo "[gen_oidc_signing_key] wrote ${PEM_PATH}"
|
|
echo "[gen_oidc_signing_key] wrote ${B64_PATH} ($(wc -c < "${B64_PATH}") bytes)"
|
|
echo
|
|
echo "Use it in your shell:"
|
|
echo " export KNOE_AUTH_OIDC_SIGNING_KEY=\$(cat ${B64_PATH})"
|