Repository navigation
Umbrella: enterprise-auth — SSO/OIDC federation + secret/credential hardening #9930
Description
Mission
Deliver the enterprise identity & access tier: SSO/OIDC federation (Okta, Azure AD, Google Workspace) and the security hardening it requires — OAuth callback-URL allowlist, client-secret encryption, encrypted credential storage + tests, rate-limit test correctness, secret-migration docs, and webhook-secret encryption for channel adapters. This tier is gated on RBAC, which is gated on the schema-layer repair (U2).
Dependency edges
- Blocked by: U2 Broken Alembic migration chain: KeyError '20260216_002' — fresh-DB upgrade impossible #9759 (Alembic chain → RBAC fresh-DB bootstrap) — enterprise auth cannot bootstrap without it. This is the critical serial edge in the graph.
- Blocks: the enterprise/sellable tier.
- needs-human-decision (implicit): SSO provider matrix + secret-rotation policy (feat(slm/auth): SSO/OIDC federation — enterprise identity provider support (Okta, Azure AD, Google Workspace) #8994 design) — surface to the owner before build.
Members (sized)
- feat(slm/auth): SSO/OIDC federation — enterprise identity provider support (Okta, Azure AD, Google Workspace) #8994 — SSO/OIDC federation — enterprise IdP support
L - security(sso): add callback URL allowlist validation for OAuth (MVA-3396) #9500 — callback-URL allowlist validation for OAuth (MVA-3396)
M(security) - security(sso): implement client secret encryption for SSO providers (MVA-3395) #9501 — client-secret encryption for SSO providers (MVA-3395)
M(security) - test(sso): add test coverage for encrypted credential storage #9685 — test coverage for encrypted credential storage
S - test(sso): fix rate limiting test mock setup #9611 — fix rate-limiting test mock setup
S - docs(sso): document SSO secret migration process #9687 — document SSO secret-migration process
S - security(telegram): encrypt webhook secret in Redis storage #9651 — encrypt Telegram webhook secret in Redis storage
S(security)
Triage delta — 2026-06-19 (unfiled-issue sweep)
- feat(sso): RP-initiated logout + session/token revocation #10151 — feat(sso): RP-initiated logout + session/token revocation
- feat(sso): enforce IdP group->instance-role mapping on JIT and login #10152 — feat(sso): enforce IdP group->instance-role mapping on JIT and login
- feat(sso): migrate SSO client secrets into the unified-secrets vault (#10088) #10153 — feat(sso): migrate SSO client secrets into the unified-secrets vault (Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) #10088)
- feat(sso): client-secret rotation — rewrap_dek + value re-seal + warn-on-stale #10154 — feat(sso): client-secret rotation — rewrap_dek + value re-seal + warn-on-stale
- docs(sso): enterprise SSO admin runbook — provider matrix + rotation policy #10155 — docs(sso): enterprise SSO admin runbook — provider matrix + rotation policy
- feat(sso): provider-health dashboard (failed-auth visibility) #10156 — feat(sso): provider-health dashboard (failed-auth visibility)
- feat(sso): deferred enterprise controls — token caching + step-up auth #10158 — feat(sso): deferred enterprise controls — token caching + step-up auth
- feat(sso): SAML Single Logout (SLO) — real NameID + registered callback route #10281 — feat(sso): SAML Single Logout (SLO) — real NameID + registered callback route
- bug(slm): SSO OAuth-state uses sync get_redis_client() with await → fails against real Redis #10284 — bug(slm): SSO OAuth-state uses sync get_redis_client() with await → fails against real Redis
- bug(rbac): two divergent permission vocabularies — colon SYSTEM_PERMISSIONS/SYSTEM_ROLES vs dot Permission enum/ROLE_PERMISSIONS #10221 — bug(rbac): two divergent permission vocabularies — colon SYSTEM_PERMISSIONS/SYSTEM_ROLES vs dot Permission enum/ROLE_PERMISSIONS
- feat(auth): cross-service revocation of RS256 authority tokens (coordinate with #10193) #10278 — feat(auth): cross-service revocation of RS256 authority tokens (coordinate with epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193)
- Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) #10088 — Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) (sub-epic — promote to top-level umbrella is a human call)
- Umbrella: SSO SCIM 2.0 inbound provisioning (v2 follow-up of #8994) #10157 — Umbrella: SSO SCIM 2.0 inbound provisioning (v2 follow-up of feat(slm/auth): SSO/OIDC federation — enterprise identity provider support (Okta, Azure AD, Google Workspace) #8994) (sub-epic — promote to top-level umbrella is a human call)
- epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193 — epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) (sub-epic — promote to top-level umbrella is a human call)
- feat(provision): seed default admin during SLM deployment; eliminate single_user mode + #6838 bypass (#10193) #10199 — feat(provision): seed default admin during SLM deployment; eliminate single_user mode + security(auth): /api/auth/login accepts ANY password for admin user #6838 bypass (epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193)
- chore(db): migrate slm_users into autobot_users, then deprecate slm_users (#10193) #10200 — chore(db): migrate slm_users into autobot_users, then deprecate slm_users (epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193)
- feat(auth): degraded-auth / network-partition handling for the SLM (#10193) #10201 — feat(auth): degraded-auth / network-partition handling for the SLM (epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193)
- chore(cleanup): remove dead single_user 503-gates after single_user elimination (#10193) #10202 — chore(cleanup): remove dead single_user 503-gates after single_user elimination (epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193)
- test(auth): cross-machine unified-identity + RBAC + two-host verification (#10193) #10203 — test(auth): cross-machine unified-identity + RBAC + two-host verification (epic(auth): unify AutoBot + SLM into ONE user store with role-based access (SLM = role-gated view, not a separate userbase) #10193)
- Task 3c-2 PR2 (#10088): dual-write connector credentials into the unified store #10333 — Task 3c-2 PR2 (Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) #10088): dual-write connector credentials into the unified store
Triage delta — 2026-06-20
- Secrets RBAC: principal resolver doesn't filter soft-deleted users/teams (residual access) #10346 — Secrets RBAC: principal resolver doesn't filter soft-deleted users/teams (residual access)
Triage delta — 2026-06-21
- Task 8.2 (#10088): secret-dependency graph — what depends on a secret (model + service) #10374 — Task 8.2 (Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) #10088): secret-dependency graph — what depends on a secret (model + service)
Triage delta — 2026-06-22
- feat(secrets): system/service access path to the unified-secrets store (System vault for non-user callers) #10436 — feat(secrets): system/service access path to the unified-secrets store (System vault for n
- feat(secrets): expose KEK rotation (rewrap_dek) on UnifiedSecretsService + API #10437 — feat(secrets): expose KEK rotation (rewrap_dek) on UnifiedSecretsService + API
Triage delta — 2026-06-22
- chore(db): migrate existing colon-style RBAC permission/role rows to canonical dot vocabulary (follow-up of #10221) #10458 — chore(db): migrate existing colon-style RBAC permission/role rows to canonical dot vocabul
Triage delta — 2026-06-26
- bug(secrets): C1 blocked — SLM cannot authenticate to System-vault /system routes (#10436 HMAC service-auth vs SLM X-Internal-API-Key, no signer) #10492 — bug(secrets): C1 blocked — SLM cannot authenticate to System-vault /system routes (feat(secrets): system/service access path to the unified-secrets store (System vault for non-user callers) #10436
- secrets: SLM LLMSettings stores provider api_key inline — should use Secrets/vaults #10503 — secrets: SLM LLMSettings stores provider api_key inline — should use Secrets/vaults
- bug(sso): KEK rotation 401s under service auth — rewrap endpoint is user-auth-only (#10498 review, #10154) #10512 — bug(sso): KEK rotation 401s under service auth — rewrap endpoint is user-auth-only (feat(sso): migrate SSO secrets to unified vault + rotation (#10153, #10154) #10498
Activity
mrveiss commentedon Jun 15, 2026
#8994 reframed: OIDC federation (Okta/Azure AD/Google Workspace), LDAP, SAML, JIT, secret encryption already exist. Converted #8994 to a sub-umbrella with v1 child issues #10150–#10156 (PKCE, RP-logout, group→role, vault migration, rotation, docs, health dashboard); SCIM #10157 + token-caching/step-up #10158 deferred. SSO secrets ride on unified-secrets #10088 (decision D2). PRD on branch
issue-8994. Note for #9930: #9500 + #9501 appear already implemented → flag for verify-and-close; #9685→C1, #9687→E folded into the sub-umbrella.mrveiss commentedon Jun 17, 2026
Batch progress — enterprise-auth umbrella
Shipped this session (PRs open):
Verified already-implemented → recommend closing (evidence on each):
_build_callback_url, MVA-3542)SSOSecretsManager+ AES-256-GCMsystem_secrets)test_sso_security.py+ migration test)Remaining real work (sub-umbrella #8994 v1): A2 RP-logout/revocation #10151 · A3 group→role #10152 · C1 vault migration #10153 · C2 rotation #10154 · E docs #10155. SCIM #10157 + caching/step-up #10158 deferred to v2.
Closures are left for human action per lifecycle rule (umbrellas #9930/#8994 stay open).
mrveiss commentedon Jun 26, 2026
Session update — 2026-06-26 (Phase C prerequisites complete + closed; C1/C2 in flight)
Closed this session (PRs already merged to Dev_new_gui; GH does not auto-close on non-default base):
rewrap_dek), merged in PR feat(secrets): service-auth System-vault access + KEK rotation (rewrap_dek) on UnifiedSecretsService + API (#10436, #10437) #10478 (0aa3e2e9a).df0c7b0c5).Landed this session:
ed60806a5) — cleared 3 high-severity CodeQLclear-text-logging-sensitive-dataalerts that feat(secrets): service-auth System-vault access + KEK rotation (rewrap_dek) on UnifiedSecretsService + API (#10436, #10437) #10478 carried into base. Root cause: the in-PR remediation renamed the log dict key (secret_id→entry_id) but CodeQL taints the valuestr(secret_id); the rename was a no-op. Fix removes the secret-id value from the three/systemaudit logs, matching the non-flaggedlistroute.Discovery filed — #10492 (Phase C / §4.1 integration surface): The merged
/systemroutes require HMACX-Service-*service-auth, but the SLM had no signer (only the sharedX-Internal-API-Key). Investigation showed the HMAC infra is already shared and tested —autobot_shared/http_client.py:sign_requestmatchesServiceAuthManager.validate_signature, andgenerate_service_keys.py/export_service_keys.pyprovision per-service keys. Recommended resolution = Option B (per-service HMAC): the secrets vault is the crown-jewels store (#10088), so a dedicated, scoped, replay-protected, revocable SLM identity beats reusing the broad shared key. Remaining gaps are additive: addslm-backendto the twoSERVICESlists + an SLMunified_vault_clientsigning with the shared helper.C1 #10153 / C2 #10154: an active parallel session is implementing both in the
issue-10153branch (vault client +sso_rotation+migrate_sso_to_unified_vault+ tests) along exactly the Option-B lines documented in #10492. Left untouched to avoid collision.Net umbrella status: Phases A (PKCE/RP-logout/group→role), D3 (health dashboard), E (docs) shipped earlier; Phase C prerequisites now merged + closed; C1/C2 in flight. Remaining members: #10153/#10154 (in progress), #10158 (v2 deferred), #10281 (SAML SLO, spun out), #10278 (RS256 revocation, coord w/ #10193), and the #10088/#10157/#10193 sub-epics (human-call to promote).
mrveiss commentedon Jun 26, 2026
C1/C2 shipped to PR — #10498
PR #10498 implements both Phase-C members (continuing the owner's own WIP, Option B per #10492):
unified_vault_client(HMAC-signed System-vault client via sharedsign_request),sso_secretsrewired to the vault with backward-compatible legacy fallback gated onis_configured(), idempotent data migration, andslm-backendadded to the key-provisioningSERVICESlists.sso_rotation(KEKrewrap_dek+ value re-seal, warn-on-stale in provider health, audit per rotation) +rotate-kek/rotate-valueendpoints (SECURITY_MANAGE).Completion fixes over the WIP (verify-don't-trust): audit was writing non-existent
AuditLogcolumns (silently swallowed) → now reusescreate_audit_log; store/delete hard-failed when the vault key was unprovisioned → legacy fallback; missingslm-backendprovisioning added. 24 tests pass. Resolves #10492. Code review in progress.mrveiss commentedon Jun 26, 2026
Follow-up #10507 — Critical fix found in code review of #10498
Code review of the merged #10498 caught a Critical the stubbed unit tests masked:
vault_rewrap_kekcalled the user-authPOST /api/v2/secrets/{id}/rewrap(Depends(principal)), so KEK rotation would 401 under service HMAC (#10437 added only the user route). PR #10507 adds the service-auth counterpartPOST /system/{secret_id}/rewrap(service_principal+coordinator.service_rotate_kek, system-vault-scoped), repoints the client, and adds backend + client tests. Also folds in review M1–M3 (migration orphan-dup guard, vault-read logging/key-guard). Value rotation was unaffected. 25 SLM tests pass.mrveiss commentedon Jun 27, 2026
Phase C complete — all enterprise-auth members merged & verified on Dev_new_gui
/system/{id}/rewrap+service_rotate_kek(KEK rotation 401'd under service auth) + M1–M3 hardenings_SECRET_TYPE(unblocked requiredcode-quality)vault_createVerified all four present on base. Closed: prereqs #10436/#10437/#10458; review issues #10492/#10512/#10515/#10528; deferred members #10158/#10278/#10281 (closed by other sessions).
Remaining open under #9930 are the human-gated PRD epics only — #10088 (secrets-unification), #10157 (SCIM 2.0 v2), #10193 (identity-unification + children #10199–10203). These are explicitly no-code-until-sign-off (PRD required); they are not part of the SSO/secret-hardening deliverable and await owner prioritization. The enterprise-auth tier itself is functionally complete.
mrveiss commentedon Jun 27, 2026
Status update (umbrella stays open per the 9919–9931 tracking convention).
Enterprise-auth deliverables are now essentially complete:
Remaining open children = the auth-unification EPIC (#10193 + #10199–#10203), which is PRD-stage (no code until sign-off per the arch decision), plus SCIM v2 (#10157) and the broad secrets-consolidation PRD (#10088). Keeping this umbrella open to track those.
mrveiss commentedon Jul 25, 2026
Housekeeping (owner-approved): the enterprise-auth SSO/OIDC federation mission of this umbrella is COMPLETE (all SSO children closed). The 3 residual open items (#10200/#10201/#10203) are user-store/auth-unification work now tracked under #10193. Closing this umbrella; no orphaned work (children re-homed to #10193).
22 remaining items