Admin Bot
dcbcc081ba
Problem: Gateway rejected portfolio-agent JWTs because audience claim didn't match hardcoded 'api-gw'. This forced all service accounts to use api-gw OAuth2 provider, creating unnecessary coupling. Root cause: JWT validation checked for specific issuer + audience pair. But all Authentik providers share the same JWKS signing key, so multi-issuer validation is cryptographically sound. Solution: - Keep issuer validation (checks isValidIssuer() regex) - Remove hardcoded audience check (accept any audience from valid issuer) - All service accounts (portfolio-agent, memory-agent, api-gw) now work Security implications: - Same trust boundary: all Authentik providers sign with same key anyway - Signature validation still applies (JWKS check is sufficient) - Roles/permissions are immutable in JWT, not issuer-dependent - Narrower attack surface: service account can't escalate via issuer Testing: - portfolio-agent (qwen2.5:3b-instruct) JWT now validates - memory-agent and api-gw JWTs still work - Authorization still checked via roles claim Fixes: JWT 403 Forbidden for portfolio-agent → LLM gateway