Repository navigation
feat(control-plane): single sign-on gate - #111
Merged
Merged
Conversation
Gate the control plane with SSO. The control plane sits behind the team's SSO or OIDC front, which authenticates the person and mints a short session; the control plane verifies that session's signature against a shared secret supplied from the environment, checks it has not expired, and checks the subject against an optional allowlist. It fails closed on anything missing, malformed, unsigned, expired, or disallowed, and any verification error is a denial. The dashboard uses the SSO authorizer when the signing material is configured and deny-all otherwise. The signing secret is read from the environment and is never logged. The open-core vault, server, and CLI never call this boundary and never depend on it. Closes #69 Signed-off-by: evdatsion <31140661+evdatsion@users.noreply.github.com>
evdatsion
added
phase-6
6 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Gates the control-plane dashboard with single sign-on.
makeSsoAuthorizerverifies that session: signature against a shared secret, expiry, and an optional subject allowlist.COHORT_CP_SSO_SIGNINGis set, and deny-all otherwise.COHORT_CP_SSO_SUBJECTSis an optional comma-separated allowlist.base64url(payload).base64url(hmacSHA256(payload))with payload{ sub, exp }in epoch seconds, the shape an SSO front would mint.Closes #69.
Security
The boundary fails closed on every path: missing, malformed, unsigned, wrong-signature, expired, or disallowed sessions are all denied, and any error during verification is a denial. The signature check uses a constant-time comparison so it does not leak via timing. The signing secret is read from the environment and is never committed and never logged, consistent with the at-rest key hygiene from #66. SSO gates only the control plane: the open-core vault, server, and CLI never call this boundary and never depend on it, so a vault keeps working with no control plane and no identity provider at all (the acceptance criterion). No open-core source changed, and the
cohort-mcpenforcement test still forbids the open-core packages from importing an sso or control-plane namespace.Tests
Seven new tests: a valid unexpired session is allowed and carries the subject; a bad signature, an expired session, a missing or malformed session, a disallowed subject, unconfigured signing material, and a payload without a subject are each denied for the right reason. Control-plane suite: 14 tests, all pass. Build, lint, audit clean; local redaction scan clean.