Repository navigation
feat: Support SVID + JWT used by service delegation - #1582
Merged
Merged
Conversation
gtema
commented
Oct 22, 2026
gtema
commented
Collaborator
- feat(auth): Accept delegated JWT bound to SVID
- docs(adr): Describe SVID plus delegated token auth
- fix(auth): Harden delegated bearer authentication
A request on the internal interface carrying both an SVID and a service grant or on-behalf-of JWT is now authenticated as that delegation. The token must be issued by the domain's own issuer, name an actor and be matched by the connection SVID against the client's spiffe_ids. The delegation is re-evaluated on every request, so revocation, role loss and chain revocation apply at once. A mismatch is a 401 and never falls back to the plain SVID identity. Assisted-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Add ADR 0036 section 8.1 and update the admin guide: Keystone accepts a service grant or on-behalf-of token only together with the acting client's SVID. Assisted-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Close the gaps found in review of the SVID plus delegated bearer path. Service grant and on-behalf-of callers may only reach read policy actions (show, list, check). The enforcer denies every other action before OPA is asked, so role-only allow rules cannot let a service mint application credentials or act as an admin on behalf of a user. An Authorization header next to an SVID on the internal interface that is not a well-formed bearer (any scheme case) is now a 401 instead of a fallback to the plain SVID identity. The service grant show and delete routes route such requests through the bound bearer path. Per-request re-evaluation reuses the already loaded grant and no longer refreshes last_redeemed_at. Rejections are logged at warn. Share one config to key repository signing algorithm conversion and cover the extractor and the policy gate with unit tests. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
gtema
enabled auto-merge
October 22, 2026 19:07
gtema
changed the title
|
Bencher Report| Project | keystone |
| Branch | service_grant |
| Testbed | ubuntu-latest |
Click to view all benchmark results
| Benchmark | Latency | Benchmark Result nanoseconds (ns) (Result Δ%) | Upper Boundary nanoseconds (ns) (Limit %) |
|---|---|---|---|
| Command_Serde/apply/remove | 📈 view plot 🚷 view threshold | 121,160.00 ns(-11.96%)Baseline: 137,614.83 ns | 263,947.71 ns (45.90%) |
| Command_Serde/apply/set | 📈 view plot 🚷 view threshold | 135,310.00 ns(-4.92%)Baseline: 142,316.67 ns | 248,562.59 ns (54.44%) |
| Command_Serde/pack/delete | 📈 view plot 🚷 view threshold | 139.15 ns(+21.19%)Baseline: 114.82 ns | 164.70 ns (84.49%) |
| Command_Serde/pack/delete_index | 📈 view plot 🚷 view threshold | 122.24 ns(+18.56%)Baseline: 103.10 ns | 144.24 ns (84.75%) |
| Command_Serde/pack/set | 📈 view plot 🚷 view threshold | 224.78 ns(+20.72%)Baseline: 186.20 ns | 271.29 ns (82.86%) |
| Command_Serde/pack/set_index | 📈 view plot 🚷 view threshold | 122.76 ns(+18.55%)Baseline: 103.55 ns | 146.53 ns (83.78%) |
| Command_Serde/unpack/delete | 📈 view plot 🚷 view threshold | 167.40 ns(+15.71%)Baseline: 144.68 ns | 217.75 ns (76.88%) |
| Command_Serde/unpack/delete_index | 📈 view plot 🚷 view threshold | 142.91 ns(+16.99%)Baseline: 122.16 ns | 182.53 ns (78.29%) |
| Command_Serde/unpack/set | 📈 view plot 🚷 view threshold | 263.70 ns(+18.27%)Baseline: 222.97 ns | 342.82 ns (76.92%) |
| Command_Serde/unpack/set_index | 📈 view plot 🚷 view threshold | 143.59 ns(+17.87%)Baseline: 121.82 ns | 180.83 ns (79.41%) |
| Payload_encryption/pack/remove_cmd | 📈 view plot 🚷 view threshold | 125.26 ns(+17.78%)Baseline: 106.35 ns | 158.85 ns (78.86%) |
| Payload_encryption/pack/set_cmd | 📈 view plot 🚷 view threshold | 217.29 ns(+13.48%)Baseline: 191.49 ns | 291.53 ns (74.53%) |
| Payload_encryption/unpack/remove_cmd | 📈 view plot 🚷 view threshold | 174.58 ns(+19.14%)Baseline: 146.54 ns | 218.77 ns (79.80%) |
| Payload_encryption/unpack/set_cmd | 📈 view plot 🚷 view threshold | 273.68 ns(+20.44%)Baseline: 227.23 ns | 349.53 ns (78.30%) |
| Raft_1Node_Latency/prefix/1node | 📈 view plot 🚷 view threshold | 2,885,000.00 ns(-19.69%)Baseline: 3,592,111.09 ns | 8,717,170.74 ns (33.10%) |
| Raft_1Node_Latency/read/1node | 📈 view plot 🚷 view threshold | 44,765.00 ns(+31.05%)Baseline: 34,158.45 ns | 52,414.01 ns (85.41%) |
| Raft_1Node_Latency/remove/1node | 📈 view plot 🚷 view threshold | 351,070.00 ns(-1.24%)Baseline: 355,461.56 ns | 602,136.58 ns (58.30%) |
| Raft_1Node_Latency/write/1node | 📈 view plot 🚷 view threshold | 369,570.00 ns(-6.27%)Baseline: 394,290.94 ns | 774,379.22 ns (47.72%) |
| build_snapshot/default | 📈 view plot 🚷 view threshold | 2,072.50 ns(+0.14%)Baseline: 2,069.50 ns | 2,780.61 ns (74.53%) |
| fernet token/project | 📈 view plot 🚷 view threshold | 1,411.30 ns(+11.77%)Baseline: 1,262.68 ns | 1,748.48 ns (80.72%) |
| get_data_keyspace | 📈 view plot 🚷 view threshold | 0.31 ns(+6.23%)Baseline: 0.29 ns | 0.38 ns (82.28%) |
| get_db | 📈 view plot 🚷 view threshold | 0.31 ns(+6.23%)Baseline: 0.29 ns | 0.38 ns (82.48%) |
| get_fernet_token_timestamp/project | 📈 view plot 🚷 view threshold | 146.43 ns(+11.86%)Baseline: 130.90 ns | 183.01 ns (80.01%) |
| get_keyspace | 📈 view plot 🚷 view threshold | 4.16 ns(-37.27%)Baseline: 6.62 ns | 15.45 ns (26.90%) |
|
🧪 Tempest Identity Compatibility Results (advisory, non-blocking) rust Failed test IDs |
|
🦢 Load Test Results Goose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
|
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 22, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.