riotpiao-poimen/homelab-frontend

Phase 3: OAuth2 Token Exchange & Identity Propagation

New Issue

Implement RFC 8693 token exchange so services can act on behalf of users with proper identity propagation, audit trail, and scoped permissions.

2025-10-01

100% Completed

P3.9: End-to-end integration test — user login through token exchange to downstream area/auth area/gateway priority/medium status/todo type/docs

by rock was closed 2026-09-08 04:45:25 +00:00

0 / 4

P3.8: Audit NetworkPolicy — downstream services must only accept gateway traffic area/downstream priority/medium status/todo type/infra

by rock was closed 2026-09-08 04:45:20 +00:00

0 / 10

P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment area/gateway priority/high status/todo type/infra

by rock was closed 2026-09-08 04:45:17 +00:00

0 / 7

P3.6: Enforce JWT auth on X-Service adapter dispatch area/auth area/gateway priority/medium status/todo type/feature

by rock was closed 2026-09-08 04:45:13 +00:00

0 / 12

P3.5: Implement RFC 8693 OAuth2 Token Exchange endpoint area/auth area/authentik area/gateway priority/high status/todo type/feature

by rock was closed 2026-09-08 04:45:09 +00:00

0 / 16

P3.4: Inject X-Forwarded-User identity headers after JWT validation area/auth area/gateway priority/high status/todo type/feature

by rock was closed 2026-09-08 04:45:06 +00:00

0 / 12

P3.3: Add /auth/refresh endpoint (token renewal) area/auth area/gateway priority/high status/todo type/feature

by rock was closed 2026-09-08 04:45:02 +00:00

0 / 8

P3.2: Enable password grant on local-llm Authentik provider area/authentik priority/high status/todo type/infra

by rock was closed 2026-09-08 04:44:59 +00:00

0 / 5

P3.1: Add /auth/token endpoint (password grant proxy) area/auth area/gateway priority/high status/todo type/feature

by rock was closed 2026-09-08 04:44:58 +00:00

0 / 11