Skip to content

Commit 6d6f487

Browse files
andrest50andrest50
authored
Merge pull request #110 from linuxfoundation/andrest50/auth0-private-key
[LFXV2-1043] Replace Auth0 client secret with private key authentication
2 parents 56fc24f + 8e45ed1 commit 6d6f487

File tree

11 files changed

+173
-74
lines changed

11 files changed

+173
-74
lines changed

‎.env.example‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@ JWT_AUTH_DISABLED_MOCK_LOCAL_PRINCIPAL=
1313
ITX_BASE_URL=https://api.dev.itx.linuxfoundation.org
1414
# OAuth2 client ID for ITX
1515
ITX_CLIENT_ID=
16-
# OAuth2 client secret for ITX (keep secure!)
17-
ITX_CLIENT_SECRET=
16+
# RSA private key in PEM format for ITX OAuth2 M2M authentication (keep secure!)
17+
# Can be loaded from file: export ITX_CLIENT_PRIVATE_KEY="$(cat path/to/private.key)"
18+
ITX_CLIENT_PRIVATE_KEY=
1819
ITX_AUTH0_DOMAIN=linuxfoundation-dev.auth0.com
1920
ITX_AUDIENCE=https://api.dev.itx.linuxfoundation.org/
2021

‎CLAUDE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ For ITX proxy functionality, configure these environment variables:
127127

128128
- `ITX_BASE_URL`: Base URL for ITX service (e.g., `https://api.itx.linuxfoundation.org`)
129129
- `ITX_CLIENT_ID`: OAuth2 client ID for ITX authentication
130-
- `ITX_CLIENT_SECRET`: OAuth2 client secret for ITX authentication
130+
- `ITX_CLIENT_PRIVATE_KEY`: RSA private key in PEM format for ITX OAuth2 M2M authentication (load from file: `export ITX_CLIENT_PRIVATE_KEY="$(cat path/to/private.key)"`)
131131
- `ITX_AUTH0_DOMAIN`: Auth0 domain for OAuth2 (e.g., `linuxfoundation.auth0.com`)
132132
- `ITX_AUDIENCE`: OAuth2 audience for ITX service (e.g., `https://api.itx.linuxfoundation.org/`)
133133

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ helm upgrade --install lfx-v2-meeting-service ./charts/lfx-v2-meeting-service \
1414
--set image.tag=latest \
1515
--set app.environment.ITX_BASE_URL.value="https://api.itx.linuxfoundation.org" \
1616
--set app.environment.ITX_CLIENT_ID.value="your-client-id" \
17-
--set app.environment.ITX_CLIENT_SECRET.value="your-client-secret"
17+
--set-file app.environment.ITX_CLIENT_PRIVATE_KEY.value=path/to/private.key
1818
```
1919

2020
### For Local Development
@@ -46,7 +46,7 @@ helm upgrade --install lfx-v2-meeting-service ./charts/lfx-v2-meeting-service \
4646
ITX_ENABLED=true
4747
ITX_BASE_URL=https://api.dev.itx.linuxfoundation.org
4848
ITX_CLIENT_ID=your-client-id
49-
ITX_CLIENT_SECRET=your-client-secret
49+
ITX_CLIENT_PRIVATE_KEY="$(cat path/to/private.key)"
5050
ITX_AUTH0_DOMAIN=linuxfoundation-dev.auth0.com
5151
ITX_AUDIENCE=https://api.dev.itx.linuxfoundation.org/
5252
```
@@ -273,7 +273,7 @@ docker run -p 8080:8080 \
273273
-e ITX_ENABLED=true \
274274
-e ITX_BASE_URL=https://api.itx.linuxfoundation.org \
275275
-e ITX_CLIENT_ID=your-client-id \
276-
-e ITX_CLIENT_SECRET=your-client-secret \
276+
-e ITX_CLIENT_PRIVATE_KEY="$(cat path/to/private.key)" \
277277
linuxfoundation/lfx-v2-meeting-service:latest
278278
```
279279

@@ -337,7 +337,7 @@ The service can be configured via environment variables:
337337
|----------|-------------|---------|
338338
| `ITX_BASE_URL` | Base URL for ITX service | `https://api.itx.linuxfoundation.org` |
339339
| `ITX_CLIENT_ID` | OAuth2 client ID for ITX | `your-client-id` |
340-
| `ITX_CLIENT_SECRET` | OAuth2 client secret for ITX | `your-client-secret` |
340+
| `ITX_CLIENT_PRIVATE_KEY` | RSA private key in PEM format for ITX OAuth2 M2M authentication | `"$(cat path/to/private.key)"` |
341341
| `ITX_AUTH0_DOMAIN` | Auth0 domain for ITX OAuth2 | `linuxfoundation.auth0.com` |
342342
| `ITX_AUDIENCE` | OAuth2 audience for ITX | `https://api.itx.linuxfoundation.org/` |
343343

‎charts/lfx-v2-meeting-service/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ apiVersion: v2
55
name: lfx-v2-meeting-service
66
description: LFX Platform V2 Meeting Service chart
77
type: application
8-
version: 0.6.0
8+
version: 0.6.1
99
appVersion: "latest"

‎charts/lfx-v2-meeting-service/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ app:
9191
# ITX_CLIENT_ID is the OAuth2 client ID for ITX service authentication
9292
ITX_CLIENT_ID:
9393
value: null
94-
# ITX_CLIENT_SECRET is the OAuth2 client secret for ITX service authentication
95-
ITX_CLIENT_SECRET:
94+
# ITX_CLIENT_PRIVATE_KEY is the RSA private key in PEM format for ITX OAuth2 M2M authentication
95+
ITX_CLIENT_PRIVATE_KEY:
9696
value: null
9797
# ITX_AUTH0_DOMAIN is the Auth0 domain for ITX OAuth2 authentication
9898
ITX_AUTH0_DOMAIN:

‎cmd/meeting-api/config.go‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ type environment struct {
3131

3232
// itxConfig holds ITX proxy configuration
3333
type itxConfig struct {
34-
BaseURL string
35-
ClientID string
36-
ClientSecret string
37-
Auth0Domain string
38-
Audience string
34+
BaseURL string
35+
ClientID string
36+
PrivateKey string
37+
Auth0Domain string
38+
Audience string
3939
}
4040

4141
// parseFlags parses command line flags for the meeting service
@@ -122,9 +122,9 @@ func parseITXConfig() itxConfig {
122122
os.Exit(1)
123123
}
124124

125-
clientSecret := os.Getenv("ITX_CLIENT_SECRET")
126-
if clientSecret == "" {
127-
slog.Error("ITX_CLIENT_SECRET environment variable is required but not set")
125+
privateKey := os.Getenv("ITX_CLIENT_PRIVATE_KEY")
126+
if privateKey == "" {
127+
slog.Error("ITX_CLIENT_PRIVATE_KEY environment variable is required but not set")
128128
os.Exit(1)
129129
}
130130

@@ -144,10 +144,10 @@ func parseITXConfig() itxConfig {
144144
}
145145

146146
return itxConfig{
147-
BaseURL: baseURL,
148-
ClientID: clientID,
149-
ClientSecret: clientSecret,
150-
Auth0Domain: auth0Domain,
151-
Audience: audience,
147+
BaseURL: baseURL,
148+
ClientID: clientID,
149+
PrivateKey: privateKey,
150+
Auth0Domain: auth0Domain,
151+
Audience: audience,
152152
}
153153
}

‎cmd/meeting-api/main.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -109,12 +109,12 @@ func run() int {
109109

110110
// Initialize ITX proxy client and services
111111
itxProxyConfig := proxy.Config{
112-
BaseURL: env.ITXConfig.BaseURL,
113-
ClientID: env.ITXConfig.ClientID,
114-
ClientSecret: env.ITXConfig.ClientSecret,
115-
Auth0Domain: env.ITXConfig.Auth0Domain,
116-
Audience: env.ITXConfig.Audience,
117-
Timeout: 30 * time.Second,
112+
BaseURL: env.ITXConfig.BaseURL,
113+
ClientID: env.ITXConfig.ClientID,
114+
PrivateKey: env.ITXConfig.PrivateKey,
115+
Auth0Domain: env.ITXConfig.Auth0Domain,
116+
Audience: env.ITXConfig.Audience,
117+
Timeout: 30 * time.Second,
118118
}
119119
itxProxyClient := proxy.NewClient(itxProxyConfig)
120120
itxMeetingService := itxservice.NewMeetingService(itxProxyClient, idMapper)

‎docs/itx-proxy-implementation.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -304,11 +304,11 @@ func (c *Client) ensureValidToken(ctx context.Context) error {
304304

305305
```bash
306306
# ITX Service Configuration
307-
ITX_BASE_URL=https://api.itx.linuxfoundation.org # ITX service URL
308-
ITX_CLIENT_ID=your-client-id # OAuth2 client ID
309-
ITX_CLIENT_SECRET=your-client-secret # OAuth2 client secret
310-
ITX_AUTH0_DOMAIN=linuxfoundation.auth0.com # Auth0 domain
311-
ITX_AUDIENCE=https://api.itx.linuxfoundation.org/ # OAuth2 audience
307+
ITX_BASE_URL=https://api.itx.linuxfoundation.org # ITX service URL
308+
ITX_CLIENT_ID=your-client-id # OAuth2 client ID
309+
ITX_CLIENT_PRIVATE_KEY="$(cat path/to/private.key)" # RSA private key in PEM format
310+
ITX_AUTH0_DOMAIN=linuxfoundation.auth0.com # Auth0 domain
311+
ITX_AUDIENCE=https://api.itx.linuxfoundation.org/ # OAuth2 audience
312312

313313
# Authentication
314314
JWKS_URL=http://lfx-platform-heimdall.lfx.svc.cluster.local:4457/.well-known/jwks
@@ -342,8 +342,8 @@ app:
342342
value: https://api.itx.linuxfoundation.org
343343
ITX_CLIENT_ID:
344344
value: null # Set via sealed secret
345-
ITX_CLIENT_SECRET:
346-
value: null # Set via sealed secret
345+
ITX_CLIENT_PRIVATE_KEY:
346+
value: null # Set via sealed secret (RSA private key in PEM format)
347347
ITX_AUTH0_DOMAIN:
348348
value: linuxfoundation.auth0.com
349349
ITX_AUDIENCE:

‎go.mod‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ module github.com/linuxfoundation/lfx-v2-meeting-service
66
go 1.24.5
77

88
require (
9+
github.com/auth0/go-auth0 v1.33.0
910
github.com/auth0/go-jwt-middleware/v2 v2.3.0
1011
github.com/google/uuid v1.6.0
1112
github.com/nats-io/nats.go v1.44.0
@@ -30,22 +31,33 @@ require (
3031
)
3132

3233
require (
34+
github.com/PuerkitoBio/rehttp v1.4.0 // indirect
3335
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
3436
github.com/cespare/xxhash/v2 v2.3.0 // indirect
3537
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
38+
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
3639
github.com/dimfeld/httppath v0.0.0-20170720192232-ee938bf73598 // indirect
3740
github.com/felixge/httpsnoop v1.0.4 // indirect
3841
github.com/go-chi/chi/v5 v5.2.3 // indirect
3942
github.com/go-logr/logr v1.4.3 // indirect
4043
github.com/go-logr/stdr v1.2.2 // indirect
44+
github.com/goccy/go-json v0.10.5 // indirect
4145
github.com/gohugoio/hashstructure v0.6.0 // indirect
4246
github.com/gorilla/websocket v1.5.3 // indirect
4347
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
4448
github.com/klauspost/compress v1.18.0 // indirect
49+
github.com/lestrrat-go/blackmagic v1.0.3 // indirect
50+
github.com/lestrrat-go/httpcc v1.0.1 // indirect
51+
github.com/lestrrat-go/httprc v1.0.6 // indirect
52+
github.com/lestrrat-go/iter v1.0.2 // indirect
53+
github.com/lestrrat-go/jwx/v2 v2.1.6 // indirect
54+
github.com/lestrrat-go/option v1.0.1 // indirect
4555
github.com/manveru/faker v0.0.0-20171103152722-9fbc68a78c4d // indirect
4656
github.com/nats-io/nkeys v0.4.11 // indirect
4757
github.com/nats-io/nuid v1.0.1 // indirect
4858
github.com/pmezard/go-difflib v1.0.0 // indirect
59+
github.com/segmentio/asm v1.2.0 // indirect
60+
go.devnw.com/structs v1.0.0 // indirect
4961
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
5062
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
5163
go.opentelemetry.io/otel/metric v1.40.0 // indirect

0 commit comments

Comments
 (0)