sansmoraxz opened a new pull request, #4055:
URL: https://github.com/apache/iggy/pull/4055
## Which issue does this PR address?
Closes #3929
## Rationale
Iggy supports only built-in credentials and HTTP-only JWT verification.
There is no mechanism for an external service to authenticate a client and
return its effective permissions, which blocks integration with centralized
identity/policy systems (like Azure AD) or automated machine fleets.
## What changed?
Login attempts on all transports (TCP, QUIC, WebSocket, HTTP) can forwarded
to a configured HTTP endpoint. The service authenticates the client and returns
one of three decisions: map to an existing Iggy user, grant a session-scoped
identity with explicit permissions, or deny. Session-scoped identities use
synthetic user IDs that are never persisted and are restricted to data-plane
operations; (capacity defined as `1_000_000`). This can be adjusted if
necessary.
### Request/response contract
```json
// Request (POST to configured URL)
{
"credential_type": "password" | "personal_access_token",
"credential": "...",
"username": "alice",
"transport": "tcp" | "http" | "quic" | "websocket",
"client_address": "10.0.0.1:5000"
}
// Response
{
"decision": "iggy_user" | "inline_grant" | "deny",
"user_id": 42,
"principal": "device-1234",
"permissions": { "global": { ... } },
"expires_at": 1700000000,
"reason": "certificate revoked"
}
```
### Configuration
```toml
[external_auth]
enabled = false
url = "https://auth.example.com/validate";
timeout = "5 s"
on_error = "deny" # "deny" | "fallback"
forward_credentials = true
```
### E2E validation
Built the server and validated the full external auth flow against a mock
auth service.
**Startup:** Server loaded the config and logged the expected warning:
**Test 1: Login `ext-alice` (inline_grant):** Mock received the callout
with `credential_type`, `credential` (forwarded), `username`, `transport:
"http"`, `client_address`. Responded with `inline_grant` granting
`read_streams`, `read_topics`, `poll_messages`, `send_messages`. Server
returned HTTP 200 with a JWT for synthetic `user_id: 4294967295` (u32::MAX,
first minted ID).
**Test 2: Login `ext-deny` (deny):** Mock responded
`{"decision":"deny","reason":"blocked by policy"}`. Server returned HTTP 401.
**Test 3: GET /streams with alice's token (allowed):** HTTP 200, body `[]`.
The grant's `read_streams: true` allowed the read.
**Test 4: POST /streams with alice's token (denied):** HTTP 403. The
grant's `manage_streams: false` blocked the mutation.
## Local Execution
- Passed
- Pre-commit hooks ran
## AI Usage
If AI tools were used, please answer:
1. Which tools? Claude, Github Copilot
2. Scope of usage? Research and implementation (some agents, some auto
completes)
3. How did you verify the generated code works correctly? Also unit tests
and validation against mock servers.
4. Can you explain every line of the code if asked? Yes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
