Skip to content

Conversation

@ozgen
Copy link
Member

@ozgen ozgen commented Feb 6, 2026

What

This PR adds OAuth2 client credentials support to gvm-auth.

It introduces a new OAuth2 token provider that can:

  • request access tokens from an OAuth2 token endpoint
  • cache tokens and refresh them when needed
  • be used from both Rust and C code via a small C API
  • use an injectable Clock abstraction to control time in unit tests
  • provide CGreen-based C tests backed by a small Rust test server (gvm-auth-test-server) that simulates an OAuth2 token endpoint.

The implementation is covered by unit tests for successful token
retrieval, error handling, and token refresh behavior.

Why

Exporting reports to OpenVAS Intelligence requires OAuth2
authentication using client credentials.

By adding this support to gvm-auth, OAuth2 handling is implemented
once in a central place and can be reused by all components that need
to export data to OpenVAS Intelligence.

References

GEA-1531

Checklist

  • Tests

@ozgen ozgen requested a review from a team as a code owner February 6, 2026 14:26
Co-authored-by: Björn Ricks <bjoern.ricks@greenbone.net>
@ozgen ozgen requested a review from bjoernricks February 10, 2026 08:17
@ozgen ozgen requested a review from bjoernricks February 10, 2026 08:43
@greenbonebot greenbonebot enabled auto-merge (rebase) February 10, 2026 12:51
@greenbonebot greenbonebot merged commit a5aae29 into main Feb 10, 2026
1 check passed
@greenbonebot greenbonebot deleted the add/add-oauth2-token-provider branch February 10, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants