Conversation
The WithOIDCConfig() function receives thvCABundle and jwksAuthTokenFile parameters but was not mapping them to OIDCConfig.CACertPath and OIDCConfig.AuthTokenFile. This meant custom CA certificates for OIDC validation were never used by the token validator. Add the two missing field mappings so the proxyrunner can use custom CA certificates when validating OIDC tokens against issuers with non-public certificates (e.g., corporate Keycloak instances). Related: #3141
There was a problem hiding this comment.
Large PR Detected
This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.
How to unblock this PR:
Add a section to your PR description with the following format:
## Large PR Justification
[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformationAlternative:
Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.
See our Contributing Guidelines for more details.
This review will be automatically dismissed once you add the justification section.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3391 +/- ##
==========================================
- Coverage 64.85% 64.82% -0.03%
==========================================
Files 375 377 +2
Lines 36626 36746 +120
==========================================
+ Hits 23753 23821 +68
- Misses 10999 11049 +50
- Partials 1874 1876 +2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
I provided the large PR justification in the opening comment.
The WithOIDCConfig() function receives thvCABundle and jwksAuthTokenFile parameters but was not mapping them to OIDCConfig.CACertPath and OIDCConfig.AuthTokenFile. This meant custom CA certificates for OIDC validation were never used by the token validator.
Add the two missing field mappings so the proxyrunner can use custom CA certificates when validating OIDC tokens against issuers with non-public certificates (e.g., corporate Keycloak instances).
Related: #3141
Large PR Justification
There's a bunch of autogenerated changes. I don't know how to split the PR so that it would still cover the feature but be small. I could have added the types and then implementation but that seems suboptimal.