Skip to content

Replace opaque Step A/B labels in XAA CRD comments #5703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jhrozek merged 2 commits into from
Jul 3, 2026
Merged

Replace opaque Step A/B labels in XAA CRD comments #5703

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
33ad545
Replace opaque Step A/B labels in XAA CRD comments with action names
jhrozek Jul 1, 2026
091392a
Rename remaining XAA Step A/B labels
jhrozek Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions cmd/thv-operator/api/v1beta1/mcpexternalauthconfig_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ const (

// ExternalAuthTypeXAA is the type for XAA (Cross-Application Access) auth.
// XAA performs a two-step token exchange to obtain access tokens for target services:
// - Step A (RFC 8693): Exchange the user's ID token at their IdP for an ID-JAG JWT
// - Step B (RFC 7523): Exchange the ID-JAG at the target app's AS for an access token
// - IdP exchange (RFC 8693): Exchange the user's ID token at their IdP for an ID-JAG JWT
// - Target grant (RFC 7523): Exchange the ID-JAG at the target app's AS for an access token
ExternalAuthTypeXAA ExternalAuthType = "xaa"
)

Expand Down Expand Up @@ -1334,24 +1334,24 @@ const (
// XAASpec holds configuration for the XAA (Cross-Application Access) auth strategy.
// XAA implements draft-ietf-oauth-identity-assertion-authz-grant (ID-JAG) — a
// two-step token exchange to obtain access tokens for target services:
// - Step A (RFC 8693): Exchange the user's ID token at their IdP for an ID-JAG JWT
// - Step B (RFC 7523): Exchange the ID-JAG at the target app's AS for an access token
// - IdP exchange (RFC 8693): Exchange the user's ID token at their IdP for an ID-JAG JWT
// - Target grant (RFC 7523): Exchange the ID-JAG at the target app's AS for an access token
type XAASpec struct {
// IDPTokenURL is the IdP token endpoint for Step A (RFC 8693 exchange).
// IDPTokenURL is the IdP token endpoint for IdP exchange (RFC 8693).
// Must be a valid HTTPS URL.
// +kubebuilder:validation:Required
// +kubebuilder:validation:Pattern=`^https://.*$`
IDPTokenURL string `json:"idpTokenUrl"`

// IDPClientID is the OAuth client ID at the IdP for Step A.
// IDPClientID is the OAuth client ID at the IdP for IdP exchange.
// +optional
IDPClientID string `json:"idpClientId,omitempty"`

// IDPClientSecretRef references a Kubernetes Secret containing the IdP client secret.
// +optional
IDPClientSecretRef *SecretKeyRef `json:"idpClientSecretRef,omitempty"`

// TargetTokenURL is the target AS token endpoint for Step B (JWT Bearer grant).
// TargetTokenURL is the target AS token endpoint for target grant (RFC 7523).
// +kubebuilder:validation:Required
TargetTokenURL string `json:"targetTokenUrl"`

Expand All @@ -1361,8 +1361,8 @@ type XAASpec struct {
// +optional
InsecureTargetTokenURL bool `json:"insecureTargetTokenUrl,omitempty"`

// TargetClientID is the OAuth client ID at the target AS for Step B.
// ID-JAG draft §9.1 RECOMMENDS confidential clients for Step B; most
// TargetClientID is the OAuth client ID at the target AS for target grant.
// ID-JAG draft §9.1 RECOMMENDS confidential clients for target grant; most
// conformant target authorization servers will reject an unauthenticated
// JWT-bearer grant per the §4.4.1 client_id continuity requirement.
// +optional
Expand All @@ -1377,7 +1377,7 @@ type XAASpec struct {
TargetAudience string `json:"targetAudience"`

// TargetResource is the RFC 8707 resource indicator sent as the `resource`
// parameter in Step A's RFC 8693 token exchange (draft §4.3, OPTIONAL). It
// parameter in IdP exchange (RFC 8693, draft §4.3, OPTIONAL). It
// identifies the target resource server — not the access-token audience, which
// is governed by TargetAudience. For MCP backends, set to the MCP server URL.
// Some authorization servers (e.g. Okta's early ID-JAG implementation) require
Expand All @@ -1386,7 +1386,7 @@ type XAASpec struct {
// +optional
TargetResource string `json:"targetResource,omitempty"`

// Scopes are the requested scopes for the XAA exchange (Steps A and B).
// Scopes are the requested scopes for the XAA exchange (IdP exchange and target grant).
// +listType=atomic
// +optional
Scopes []string `json:"scopes,omitempty"`
Expand All @@ -1399,7 +1399,7 @@ type XAASpec struct {
SubjectProviderName string `json:"subjectProviderName,omitempty"`

// SubjectTokenType is the token-type URN of the upstream subject token
// used in Step A. Defaults to "urn:ietf:params:oauth:token-type:id_token"
// used in IdP exchange. Defaults to "urn:ietf:params:oauth:token-type:id_token"
// when empty.
// +kubebuilder:validation:Enum="urn:ietf:params:oauth:token-type:id_token"
// +optional
Expand Down
32 changes: 16 additions & 16 deletions deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpexternalauthconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1377,7 +1377,7 @@ spec:
properties:
idpClientId:
description: IDPClientID is the OAuth client ID at the IdP for
Step A.
IdP exchange.
type: string
idpClientSecretRef:
description: IDPClientSecretRef references a Kubernetes Secret
Expand All @@ -1395,7 +1395,7 @@ spec:
type: object
idpTokenUrl:
description: |-
IDPTokenURL is the IdP token endpoint for Step A (RFC 8693 exchange).
IDPTokenURL is the IdP token endpoint for IdP exchange (RFC 8693).
Must be a valid HTTPS URL.
pattern: ^https://.*$
type: string
Expand All @@ -1407,7 +1407,7 @@ spec:
type: boolean
scopes:
description: Scopes are the requested scopes for the XAA exchange
(Steps A and B).
(IdP exchange and target grant).
items:
type: string
type: array
Expand All @@ -1422,7 +1422,7 @@ spec:
subjectTokenType:
description: |-
SubjectTokenType is the token-type URN of the upstream subject token
used in Step A. Defaults to "urn:ietf:params:oauth:token-type:id_token"
used in IdP exchange. Defaults to "urn:ietf:params:oauth:token-type:id_token"
when empty.
enum:
- urn:ietf:params:oauth:token-type:id_token
Expand All @@ -1433,8 +1433,8 @@ spec:
type: string
targetClientId:
description: |-
TargetClientID is the OAuth client ID at the target AS for Step B.
ID-JAG draft §9.1 RECOMMENDS confidential clients for Step B; most
TargetClientID is the OAuth client ID at the target AS for target grant.
ID-JAG draft §9.1 RECOMMENDS confidential clients for target grant; most
conformant target authorization servers will reject an unauthenticated
JWT-bearer grant per the §4.4.1 client_id continuity requirement.
type: string
Expand All @@ -1455,7 +1455,7 @@ spec:
targetResource:
description: |-
TargetResource is the RFC 8707 resource indicator sent as the `resource`
parameter in Step A's RFC 8693 token exchange (draft §4.3, OPTIONAL). It
parameter in IdP exchange (RFC 8693, draft §4.3, OPTIONAL). It
identifies the target resource server — not the access-token audience, which
is governed by TargetAudience. For MCP backends, set to the MCP server URL.
Some authorization servers (e.g. Okta's early ID-JAG implementation) require
Expand All @@ -1464,7 +1464,7 @@ spec:
type: string
targetTokenUrl:
description: TargetTokenURL is the target AS token endpoint for
Step B (JWT Bearer grant).
target grant (RFC 7523).
type: string
required:
- idpTokenUrl
Expand Down Expand Up @@ -2979,7 +2979,7 @@ spec:
properties:
idpClientId:
description: IDPClientID is the OAuth client ID at the IdP for
Step A.
IdP exchange.
type: string
idpClientSecretRef:
description: IDPClientSecretRef references a Kubernetes Secret
Expand All @@ -2997,7 +2997,7 @@ spec:
type: object
idpTokenUrl:
description: |-
IDPTokenURL is the IdP token endpoint for Step A (RFC 8693 exchange).
IDPTokenURL is the IdP token endpoint for IdP exchange (RFC 8693).
Must be a valid HTTPS URL.
pattern: ^https://.*$
type: string
Expand All @@ -3009,7 +3009,7 @@ spec:
type: boolean
scopes:
description: Scopes are the requested scopes for the XAA exchange
(Steps A and B).
(IdP exchange and target grant).
items:
type: string
type: array
Expand All @@ -3024,7 +3024,7 @@ spec:
subjectTokenType:
description: |-
SubjectTokenType is the token-type URN of the upstream subject token
used in Step A. Defaults to "urn:ietf:params:oauth:token-type:id_token"
used in IdP exchange. Defaults to "urn:ietf:params:oauth:token-type:id_token"
when empty.
enum:
- urn:ietf:params:oauth:token-type:id_token
Expand All @@ -3035,8 +3035,8 @@ spec:
type: string
targetClientId:
description: |-
TargetClientID is the OAuth client ID at the target AS for Step B.
ID-JAG draft §9.1 RECOMMENDS confidential clients for Step B; most
TargetClientID is the OAuth client ID at the target AS for target grant.
ID-JAG draft §9.1 RECOMMENDS confidential clients for target grant; most
conformant target authorization servers will reject an unauthenticated
JWT-bearer grant per the §4.4.1 client_id continuity requirement.
type: string
Expand All @@ -3057,7 +3057,7 @@ spec:
targetResource:
description: |-
TargetResource is the RFC 8707 resource indicator sent as the `resource`
parameter in Step A's RFC 8693 token exchange (draft §4.3, OPTIONAL). It
parameter in IdP exchange (RFC 8693, draft §4.3, OPTIONAL). It
identifies the target resource server — not the access-token audience, which
is governed by TargetAudience. For MCP backends, set to the MCP server URL.
Some authorization servers (e.g. Okta's early ID-JAG implementation) require
Expand All @@ -3066,7 +3066,7 @@ spec:
type: string
targetTokenUrl:
description: TargetTokenURL is the target AS token endpoint for
Step B (JWT Bearer grant).
target grant (RFC 7523).
type: string
required:
- idpTokenUrl
Expand Down
Loading
Loading