Returns Authentik error verbatim on bad credentials (401)
No JWT validation on this endpoint (it issues tokens, does not consume them)
Config: auth.tokenUrl, auth.clientId, auth.clientSecret in ConfigMap/Secret
Unit tests with mock Authentik responses
Integration test against real Authentik (manual, documented)
Implementation
New file: internal/proxy/auth_endpoints.go
Wire in proxy.go ServeHTTP before JWT check block
Config additions in internal/config/config.go
Depends on
P3.2 (Authentik provider must support password grant)
Review checklist
No credentials logged (password, client_secret, tokens)
Rate limiting considered (Authentik has built-in, but gateway should not amplify)
Error responses use RFC 9457 problem detail format consistently
## Summary
Gateway exposes `POST /auth/token` that accepts username+password, exchanges with Authentik via `grant_type=password`, returns JWT + refresh token.
## Why
Users should not need to know about OIDC flows or manually craft token requests against Authentik. Gateway is the single entry point.
## Acceptance Criteria
- [ ] `POST /auth/token` accepts `{"username":"...","password":"...","scope":"..."}`
- [ ] Proxies to Authentik token endpoint with `grant_type=password`
- [ ] Returns `{"access_token":"...","refresh_token":"...","expires_in":...,"token_type":"Bearer"}`
- [ ] Returns Authentik error verbatim on bad credentials (401)
- [ ] No JWT validation on this endpoint (it issues tokens, does not consume them)
- [ ] Config: `auth.tokenUrl`, `auth.clientId`, `auth.clientSecret` in ConfigMap/Secret
- [ ] Unit tests with mock Authentik responses
- [ ] Integration test against real Authentik (manual, documented)
## Implementation
- New file: `internal/proxy/auth_endpoints.go`
- Wire in `proxy.go` ServeHTTP before JWT check block
- Config additions in `internal/config/config.go`
## Depends on
- P3.2 (Authentik provider must support password grant)
## Review checklist
- [ ] No credentials logged (password, client_secret, tokens)
- [ ] Rate limiting considered (Authentik has built-in, but gateway should not amplify)
- [ ] Error responses use RFC 9457 problem detail format consistently
rock
added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 03:54:36 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Gateway exposes
POST /auth/tokenthat accepts username+password, exchanges with Authentik viagrant_type=password, returns JWT + refresh token.Why
Users should not need to know about OIDC flows or manually craft token requests against Authentik. Gateway is the single entry point.
Acceptance Criteria
POST /auth/tokenaccepts{"username":"...","password":"...","scope":"..."}grant_type=password{"access_token":"...","refresh_token":"...","expires_in":...,"token_type":"Bearer"}auth.tokenUrl,auth.clientId,auth.clientSecretin ConfigMap/SecretImplementation
internal/proxy/auth_endpoints.goproxy.goServeHTTP before JWT check blockinternal/config/config.goDepends on
Review checklist