Repository navigation
ci: add an AS pairwise conformance leg - #650
Merged
Merged
Conversation
With -pairwise-subjects, cmd/conformance-as gives every client pairwise subject identifiers, derived by pairwise.NewReversible under keys generated at startup, with the prefix ppid:. JWT access tokens keep working: serverresource maps a pairwise sub back to the end user at /userinfo. A smoke test drives the code flow with JWT and opaque access tokens and checks the ID token, UserInfo and refreshed ID token all carry the same pairwise sub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 24th configuration runs the AS baseline plan and variant (private_key_jwt, DPoP, OpenID Connect) against conformance-as-pairwise, a conformance AS started with -pairwise-subjects. Every ID token, UserInfo response and refreshed ID token the suite checks then carries the client's pairwise sub, and JWT access tokens are mapped back to the end user at the resource side. setup-config gains a pairwise profile (alias gofapi-pairwise), which writes pairwise-plan.json and patches the committed pairwise.config.json. run-all.sh brings the container up and runs the leg after AS baseline, with empty expected warnings and skips like baseline's. AGENTS.md notes the -pairwise alias suffix, and the docs count twenty-four configurations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a 24th conformance configuration, AS pairwise: the AS baseline plan and variant (
private_key_jwt, DPoP, plain FAPI, OpenID Connect) run against a conformance AS that gives every client pairwise subject identifiers (OpenID Connect Core §8).Conformance AS
-pairwise-subjectsflag oncmd/conformance-as:Config.Subjectsbecomes pairwise for every client (pairwise.Reversible, prefixppid:), derived bypairwise.NewReversibleunder keys generated at startup and kept in memory. Subs are stable for the life of the process, which is all one leg needs.serverresourcemaps the pairwise sub back to the end user at/userinfo, which returns the same pairwisesubas the ID token.ppid:-prefixed sub.The leg
conformance-as-pairwise(host port 18458), with its own committedpairwise.config.json;setup-configgains apairwiseprofile (aliasgofapi-pairwise) that writespairwise-plan.jsonand patches the config, as for baseline.run-all.shbrings the container up and runs the leg right after AS baseline. Expected warnings and skips start empty, as baseline's are.Docs: the oidf-config README gains a pairwise section; the workflow, READMEs and ARCHITECTURE now count twenty-four configurations; AGENTS.md notes that a pairwise run appends
-pairwiseto the alias of the matrix cell it repeats (e.g.fapigo-sp-pkjwt-dpop-pairwise).🤖 Generated with Claude Code