feat(providers): support multiple dynamic credential injections on one request
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- rust
- 领域
- api, authentication, security
调研方向
首先定位 provider endpoint 匹配、动态 token 授予解析和出站 header 注入的入口点；issue 未指定任何文件或测试。使用验收标准定义独立授予、失败原子性、冲突、脱敏、缓存和隔离的覆盖范围；完成意味着所有列出的安全性和并发行为都已得到验证。
由索引模型根据 Issue 内容生成。
描述
Summary
Support multiple independently resolved dynamic credential injections on one matching outbound HTTP request, including a SPIFFE JWT-SVID in a configured custom header and an independent Authorization: Bearer access token.
Problem
The POC has an outbound route where two separate security layers protect the same request:
- An identity-aware proxy or service requires a dynamically obtained SPIFFE JWT-SVID in a configured custom header.
- The destination service requires a separately acquired short-lived bearer access token in
Authorization.
Providers v2 can describe bearer or custom-header placement for a dynamic token grant, but the provider/request contract needs to support composing multiple dynamic credentials for the same endpoint without materializing either token in the agent environment or adding an application-side proxy.
This is not a request to duplicate one token into arbitrary headers. Each injection has its own issuer, audience, scopes, cache lifetime, and failure semantics.
Requested behavior
- Allow a provider endpoint to reference multiple dynamic token-grant credentials for one request.
- Resolve and inject each credential only after endpoint and L7 policy admission.
- Support at least:
- injection of a SPIFFE JWT-SVID into a provider-configured custom header for Teleport-based or other SPIFFE-compatible services;
- an independently resolved
Authorization: Bearer <token>credential for the destination service.
- Keep grant configuration independent per credential: token endpoint, JWT-SVID audience, resource audience, scopes, header placement, and cache TTL.
- Define deterministic conflict behavior when the agent supplies either protected header. The default should replace or reject according to explicit provider policy, never silently forward an untrusted agent value.
- Resolve all required credentials before forwarding; if any grant fails, inject none and fail closed.
- Redact both credentials from agent-visible state, logs, traces, errors, and policy events.
Acceptance criteria
- One HTTPS request matching a provider endpoint can receive both a SPIFFE JWT-SVID in a provider-configured custom header and an independently acquired bearer token.
- The two grants may use different token endpoints, audiences, scopes, and cache expiration times.
- Actual credential values and reusable credential handles are never exposed to the sandbox or agent. A non-secret opaque placeholder may be visible to the agent, provided credential substitution remains endpoint-scoped and enforced by the Supervisor.
- Header injection occurs only for the matched scheme, host, port, and path and only when TLS inspection is active.
- A failure in either grant prevents the upstream request and does not leave a partially injected request.
- Concurrent requests do not mix credentials across sandbox, provider instance, subject, audience, or endpoint.
- Tests cover cache hit/expiry, independent refresh, agent-supplied header conflicts, one-grant failure, redaction, and cross-sandbox isolation.
Example use case
Agent -> OpenShell Supervisor -> identity-aware proxy -> destination service
The Supervisor performs last-mile injection of:
- A SPIFFE JWT-SVID required by the identity-aware proxy.
- A separate short-lived bearer token required by the destination service.
The two credentials may have different issuers, audiences, scopes, token endpoints, and expiration times. Neither credential is exposed to the agent.
- 主要语言
- Rust
- 星标
- 13.2k
- 派生
- 1.6k
- 平均合并
- 1 天 23 小时
- 30 天内合并 PR
- 355
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
NVIDIA/OpenShell 的其他 Issue
-
area:cli os:linux os:macos state:validated
难度 2/5 1-3 小时 新手友好度 88/100
NVIDIA/OpenShell#4042 · 2 条评论 ·
维护者通常 1 天内回复
-
state:triage-needed
难度 2/5 1-3 小时 新手友好度 72/100
NVIDIA/OpenShell#3995 · 2 条评论 ·
维护者通常 1 天内回复
-
state:triage-needed
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
state:triage-needed
难度 1/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
area:docs
难度 1/5 1 小时以内 新手友好度 88/100
维护者通常 1 天内回复
相似的 Issue
-
Change output crossing a compactsize boundary leaves the fee slightly below the requested feerate未关闭bug
难度 2/5 1-3 小时 新手友好度 78/100
bitcoindevkit/bdk_wallet#578 ·
维护者通常 8 天内回复
-
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
521xueweihan/HelloGitHub#3832 ·
-
难度 2/5 1-3 小时 新手友好度 84/100
-
难度 2/5 1-3 小时 新手友好度 82/100
canonical/opentelemetry-collector-operator#409 ·
维护者通常 1 天内回复