Problem: Gateway rejected portfolio-agent JWTs because audience claim
didn't match hardcoded 'api-gw'. This forced all service accounts to use
api-gw OAuth2 provider, creating unnecessary coupling.
Root cause: JWT validation checked for specific issuer + audience pair.
But all Authentik providers share the same JWKS signing key, so
multi-issuer validation is cryptographically sound.
Solution:
- Keep issuer validation (checks isValidIssuer() regex)
- Remove hardcoded audience check (accept any audience from valid issuer)
- All service accounts (portfolio-agent, memory-agent, api-gw) now work
Security implications:
- Same trust boundary: all Authentik providers sign with same key anyway
- Signature validation still applies (JWKS check is sufficient)
- Roles/permissions are immutable in JWT, not issuer-dependent
- Narrower attack surface: service account can't escalate via issuer
Testing:
- portfolio-agent (qwen2.5:3b-instruct) JWT now validates
- memory-agent and api-gw JWTs still work
- Authorization still checked via roles claim
Fixes: JWT 403 Forbidden for portfolio-agent → LLM gateway
Admin Bot