feat(auth): grant platform admin by OIDC subject in gateway config - #2701
Draft
jhjaggars wants to merge 2 commits into
Draft
feat(auth): grant platform admin by OIDC subject in gateway config#2701jhjaggars wants to merge 2 commits into
jhjaggars wants to merge 2 commits into
Conversation
Add admin_subjects to the gateway OIDC configuration — a list of OIDC sub claim values that are granted Platform Admin privileges regardless of their JWT role claims. Works alongside the existing admin_role check: either mechanism grants admin access. Introduce AdminPolicy struct that bundles admin_role and admin_subjects, replacing the flat admin_role: String threading through ServerState and all gRPC handler call sites. This localizes the admin-grant logic and prevents future churn if more admin criteria are added. The feature supports the single-owner gateway use case where the IdP does not carry OpenShell-specific roles. A gateway operator configures their own sub as an admin subject and uses OIDC purely for identity. - Config: admin_subjects field on OidcConfig (Vec<String>) - CLI: --oidc-admin-subjects flag, OPENSHELL_OIDC_ADMIN_SUBJECTS env var - Middleware RBAC: AuthzPolicy.admin_subjects checked in check() - Workspace authz: AdminPolicy.admin_subjects checked in is_platform_admin() - Helm: server.oidc.adminSubjects value and template rendering - Docs: gateway-config.mdx updated with new TOML field - Tests: 6 new tests covering subject-based admin, role coexistence, auth-only no-op, and negative cases Closes NVIDIA#2613 Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
When admin_subjects is configured but admin_role and user_role are empty, the previous code still treated every authenticated user as Platform Admin (auth-only mode). Now auth-only mode only activates when both admin_role and admin_subjects are empty. With admin_subjects set and roles empty: - Admin methods are restricted to listed subjects only - User-level methods remain open to all authenticated callers Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
jhjaggars
force-pushed
the
feat/admin-subjects
branch
from
August 11, 2026 15:04
022ba20 to
6483725
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
admin_subjectsto the OIDC gateway config — a list of OIDC subject (subclaim) values that are granted Platform Admin regardless of their JWT role claims. Works alongsideadmin_role— either mechanism grants admin access. This is a no-op in auth-only mode (when bothadmin_roleanduser_roleare empty).This enables granting admin to specific identity-provider users without requiring a dedicated admin role assignment in the IdP, which is useful for bootstrapping, break-glass access, and IdPs where role management is inconvenient.
Related Issue
No issue required: self-contained auth enhancement with config, server, Helm, and docs changes in a single commit.
Changes
openshell-core: Addadmin_subjects: Vec<String>toOidcConfig(serde-default, backward compatible).openshell-server/auth/authz.rs:AuthzPolicygainsadmin_subjects: HashSet<String>. Role checks now also pass if the caller'ssubis inadmin_subjects.openshell-server/auth/workspace_authz.rs: ExtractAdminPolicystruct bundlingadmin_role+admin_subjects. Replace bare&stradmin-role parameters with&AdminPolicyacrossauthorize_workspace,authorize_sandbox_workspace,require_platform_admin, andis_platform_admin_principal.openshell-servergRPC handlers: ThreadAdminPolicythrough all RPC handlers that check platform admin (sandbox, workspace, policy, provider, inference, service).openshell-server/cli.rs: Logadmin_subjectscount at startup when non-empty.server.oidc.adminSubjectslist value, renderadmin_subjects = [...]ingateway-config.yaml.admin_subjectsrow todocs/reference/gateway-config.mdx.Testing
mise run pre-commitpassesopenshell-adminrole from test user, confirmed Platform Admin access viaadmin_subjectsmatch aloneChecklist