miki3421 opened a new pull request, #52: URL: https://github.com/apache/openserverless-admin-api/pull/52
`0.9.0` lacks the OIDC endpoints required by the SSO-capable CLI. This draft ports the OIDC validator, namespace mapping, device/password flows and login-triggered WhiskUser provisioning from `0.9.1` (`35f9a1bcac5f75aab6dfac07d7efa6ac1bd0ae56`). The backport uses `openserverless.org/v1` in namespace `openserverless`. The existing Kubernetes client, dependencies, authorization decorator and password authentication functions remain unchanged; the constructor only adds the optional client injection already present upstream. OIDC flows retain their existing logic. New configuration examples and documentation explain the deployment prerequisites. ### Validation - 31 unit tests passed, including five legacy authentication checks and assertions for the `0.9.0` WhiskUser API group/namespace. - Existing doctests passed across all nine common modules. - AST comparison confirms all pre-existing authentication service and REST functions are unchanged, excluding the optional constructor injection. - Four local HTTP integration scenarios passed against the companion mock provider: valid confidential login, wrong password, wrong client secret and missing required group. CouchDB and Kubernetes were mocked. - CI retains `task utest` and adds a separate `task utest-sso` step. - `git diff --check` passed. The existing password endpoint keeps its metadata response; the new OIDC endpoints return the flat payload consumed by SSO clients. The upstream OIDC documentation incorrectly described these response shapes as identical; only that description is corrected here. This draft requires coordinated SSO tasks and a build/release of the admin-api image before deployment. No image tags, deployed services or live IdP configuration were changed. No live cluster test was run. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
