miki3421 opened a new pull request, #53: URL: https://github.com/apache/openserverless-admin-api/pull/53
`0.9.0` lacks the OIDC endpoints required by the SSO-capable CLI. This draft ports the OIDC validator, namespace mapping, device/password flows and login-triggered WhiskUser provisioning from `0.9.1` (`35f9a1bcac5f75aab6dfac07d7efa6ac1bd0ae56`). The backport uses `openserverless.org/v1` in namespace `openserverless`. The existing Kubernetes client, dependencies, authorization decorator and password authentication functions remain unchanged; the constructor only adds the optional client injection already present upstream. OIDC flows retain their existing logic. New configuration examples and documentation explain the deployment prerequisites. ### Validation - 31 unit tests passed, including five legacy authentication checks and assertions for the `0.9.0` WhiskUser API group/namespace. - Existing doctests passed across all nine common modules. - AST comparison confirms all pre-existing authentication service and REST functions are unchanged, excluding the optional constructor injection. - Four local HTTP integration scenarios passed against the companion mock provider: valid confidential login, wrong password, wrong client secret and missing required group. CouchDB and Kubernetes were mocked. - CI retains `task utest` and adds a separate `task utest-sso` step. - `git diff --check` passed. The existing password endpoint keeps its metadata response; the new OIDC endpoints return the flat payload consumed by SSO clients. The upstream OIDC documentation incorrectly described these response shapes as identical; only that description is corrected here. Deployment requires the coordinated SSO tasks and an admin-api image built from this backport. Subsequent validation built and deployed this exact commit in a KVM guest: all 32 checks against Keycloak 26.4.2 over HTTP passed, including password/device login, real operator provisioning, action invocation, negative authentication cases and legacy login with SSO enabled/disabled. The original source image pins are unchanged. ### Companion drafts - [task PR](https://github.com/apache/openserverless-task/pull/229) - [testing PR](https://github.com/apache/openserverless-testing/pull/13) - [cli PR](https://github.com/apache/openserverless-cli/pull/52) Supersedes https://github.com/apache/openserverless-admin-api/pull/52 with the same commits proposed from a personal fork. The previous Apache branch is retained. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
