Support workload identity federation for plugin credentials

未关闭
  • 哪里不对？
#3,122 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
aws, azure, gcp, typescript
领域
authentication, backend-api-design, security

调研方向

Start with packages/junior-plugin-api/src/manifest.ts, chat/pi/gateway-auth.ts, and the existing grantForEgress/issueCredential lease path referenced in the issue. Read how plugin credentials are declared and how host egress caches leases. The issue is done when plugins can declare a host-minted, refreshed federated credential with a configurable header and the stated security controls, with GCP as the first exchange provider.

由索引模型根据 Issue 内容生成。

描述

Plugins cannot authenticate to services that need short-lived credentials issued to a workload, such as apps behind Google Cloud IAP. Vercel issues per-deployment OIDC tokens that GCP (and AWS/Azure) can trust through workload identity federation, so no long-lived cloud key is needed. Junior has no shared primitive for this.

Current behavior

  • Manifest credentials support only oauth-bearer (packages/junior-plugin-api/src/manifest.ts): a token from a host env var or per-user OAuth, injected for the listed domains. api-headers are static values with env refs.
  • Packaged plugins can issue short-lived header leases with grantForEgress + issueCredential (the GitHub plugin does this). Host egress caches a lease until its expiresAt.
  • Core uses Vercel OIDC only for AI Gateway auth (chat/pi/gateway-auth.ts) and for verifying sandbox egress requests. Plugins have no way to get the deployment's OIDC token, and there is no shared GCP token exchange.

Gap

  • IAP needs a Google-signed credential that is valid for at most 1h. A static env token cannot work. The only option today is a JSON service account key in env, which is the long-lived secret that federation removes.
  • Every plugin that needs this must rebuild Vercel OIDC → Google STS → IAM Credentials, with its own caching and security checks.
  • Some upstreams use Authorization for their own auth (Redash: Authorization: Key …). The proxy credential then has to go in Proxy-Authorization, which IAP supports. Manifest credentials cannot choose the header today.

Capabilities identified in design discussion

  • Host workload identity exchange: a plugin credential trades the deployment's Vercel OIDC token for a short-lived cloud credential. GCP first: STS exchange, then IAM Credentials (signJwt, generateIdToken, generateAccessToken) on one named service account.
  • Declared in plugin.yaml: a plugin such as Redash should need no code. Inputs: domains, workload identity provider audience, service account, token kind and audience (for example an IAP service-account JWT with aud: https://<host>/*), and target header.
  • Configurable target header, including Proxy-Authorization, used alongside static api-headers.
  • Lease caching and refresh before expiry, through the existing egress lease path.
  • Security invariants:
    • Mint only on the host. Never expose the token to the sandbox or the model.
    • No long-lived cloud keys.
    • Document the provider attribute condition that limits trust to production deployments (sub = owner:<team>:project:<project>:environment:production), because team members can pull development OIDC tokens locally.
    • Emit telemetry for each mint.

Motivating case

An internal Redash instance behind Google Cloud IAP. IAP accepts JWTs signed by a service account with aud set to the app URL, and accepts them in Proxy-Authorization (IAP programmatic auth). This works even when IAP uses the Google-managed OAuth client. Vercel documents the GCP federation setup in Connect to GCP.

via @dcramer.

--

View Session [Sentry]

主要语言
TypeScript
星标
397
派生
43
平均合并
8 小时 28 分钟
30 天内合并 PR
764

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

getsentry/junior 的其他 Issue

查看 getsentry/junior 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。