feat(conformance-as): add OpenID Federation self-issuance support - #261
Open
osanderson wants to merge 2 commits into
Open
feat(conformance-as): add OpenID Federation self-issuance support#261osanderson wants to merge 2 commits into
osanderson wants to merge 2 commits into
Conversation
Adds an optional "federation" config block wiring server.Config.Federation and server.Config.AutomaticRegistration into cmd/conformance-as, and serves the resulting self-issued Entity Configuration at /.well-known/openid-federation — carrying the same discovery document already served at /.well-known/openid-configuration as its own "openid_provider" Entity Type metadata, plus client_registration_types_supported: ["automatic"] (OpenID Federation 1.0 §12.1's own MUST for an OP supporting Automatic Registration). Omitting the "federation" key from the config file disables all of this entirely, matching the module's own established "zero/nil disables the feature" convention — every existing config file and test call site is unaffected. First step toward a real OpenID Federation conformance run against this binary; verified with a new smoke test that starts the real production wiring, fetches the well-known endpoint over real TLS, and verifies the returned statement self-verifies and carries the expected metadata. The actual live suite run (docker-compose service, trust anchor setup, automatic registration exercised end to end) follows in a later change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017N2kkxv9BR4Qmj8De3Ucs6
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Config.Resolve had no direct test coverage at all before this PR (every existing config_test.go case calls the unexported per-client resolveClient helper instead) — this PR's own federation validation additions inherited that gap wholesale, failing both codecov/patch and SonarCloud's new_coverage gate. Adds direct Resolve tests: a valid config with no federation block, a valid one with federation, every federation validation failure this PR added, and (as a side effect of finally exercising Resolve directly) the handful of pre-existing top-level validation branches that had never been covered either. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017N2kkxv9BR4Qmj8De3Ucs6
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
"federation"config block wiringserver.Config.Federationandserver.Config.AutomaticRegistrationintocmd/conformance-as, and serves the resulting self-issued Entity Configuration at/.well-known/openid-federation— carrying the same discovery document already served at/.well-known/openid-configurationas its ownopenid_providerEntity Type metadata, plusclient_registration_types_supported: ["automatic"](OpenID Federation 1.0 §12.1's own MUST for an OP supporting Automatic Registration)."federation"key from the config file disables all of this entirely — every existing config file and test call site is unaffected.~/githome/fapi/conformance-suitehas Federation test plans). The actual live suite run — docker-compose service, trust anchor setup, automatic registration exercised end to end — follows in a later change.Test plan
go build ./...go test -race ./...golangci-lint run ./...— 0 issuesnewServerMux) withConfig.Federationset, fetches/.well-known/openid-federationover real TLS, verifies the returned statement self-verifies against its own claimed key, and carries the expectedopenid_providermetadata.🤖 Generated with Claude Code
https://claude.ai/code/session_017N2kkxv9BR4Qmj8De3Ucs6