riotpiao-poimen/homelab

Phase 3: OAuth2 Token Exchange & Identity Propagation

New Issue

Implement RFC 8693 token exchange for api-gateway. Code lives in rock/homelab-frontend, infra/config in rock/homelab.

2025-10-01

0% Completed

P3.9: End-to-end integration test — full auth flow area/auth priority/medium status/todo type/docs

opened 2026-09-08 04:43:06 +00:00 by rock

API-GW OAuth 0 / 3

P3.8: Audit NetworkPolicy — downstream must only accept gateway traffic area/downstream priority/medium status/review status/todo type/infra

opened 2026-09-08 04:43:00 +00:00 by rock

API-GW OAuth 0 / 6

P3.7: Wire auth config (tokenUrl, clientId, clientSecret) into gateway deployment area/gateway priority/high status/todo type/infra

opened 2026-09-08 04:42:55 +00:00 by rock

API-GW OAuth 0 / 4

P3.6: Enforce JWT auth on X-Service adapter dispatch area/auth area/gateway priority/medium status/todo type/feature

opened 2026-09-08 04:42:44 +00:00 by rock

API-GW OAuth 0 / 5

P3.5: Implement RFC 8693 OAuth2 Token Exchange endpoint area/auth area/authentik area/gateway priority/high status/todo type/feature

opened 2026-09-08 04:42:06 +00:00 by rock

API-GW OAuth 0 / 7

P3.4: Inject X-Forwarded-User identity headers after JWT validation area/auth area/gateway priority/high status/todo type/feature

opened 2026-09-08 04:42:00 +00:00 by rock

API-GW OAuth 0 / 7

P3.3: Add /auth/refresh endpoint (token renewal) area/auth area/gateway priority/high status/todo type/feature

opened 2026-09-08 04:41:45 +00:00 by rock

API-GW OAuth 0 / 4

P3.2: Enable password grant on local-llm Authentik provider area/authentik priority/high status/todo type/infra

opened 2026-09-08 04:41:11 +00:00 by rock

API-GW OAuth 0 / 4

P3.1: Add /auth/token endpoint (password grant proxy) area/auth area/gateway priority/high status/todo type/feature

opened 2026-09-08 04:40:45 +00:00 by rock

API-GW OAuth 0 / 10