Jeroen SchweitzerandClaude Opus 4.5
6ce34cc016
- Changed oidc_audience (string) to oidc_audiences (list) - Now accepts tokens with audience: core-api, tatlock-ui, tatlock - Fixes environment endpoint returning "default" user when using tatlock-ui token (audience mismatch was causing JWT claims error) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
40 lines
1.1 KiB
Python
40 lines
1.1 KiB
Python
"""
|
|
Security initialization module
|
|
|
|
Handles OIDC configuration and authentication setup
|
|
"""
|
|
from src.shared.config import Settings
|
|
from src.shared.logging import get_logger
|
|
|
|
logger = get_logger(__name__)
|
|
|
|
|
|
def initialize_oidc(settings: Settings) -> None:
|
|
"""
|
|
Initialize OIDC authentication configuration
|
|
|
|
Args:
|
|
settings: Application settings containing OIDC configuration
|
|
"""
|
|
# Import here to avoid circular imports
|
|
# Configure BOTH oidc modules (src.auth and src.domains.auth)
|
|
from src.auth.oidc import oidc_config as auth_oidc_config
|
|
from src.domains.auth.oidc import oidc_config as domains_oidc_config
|
|
|
|
auth_oidc_config.configure(
|
|
enabled=settings.oidc_enabled,
|
|
issuer=settings.oidc_issuer,
|
|
audiences=settings.oidc_audiences
|
|
)
|
|
|
|
domains_oidc_config.configure(
|
|
enabled=settings.oidc_enabled,
|
|
issuer=settings.oidc_issuer,
|
|
audiences=settings.oidc_audiences
|
|
)
|
|
|
|
if settings.oidc_enabled:
|
|
logger.info(f"OIDC authentication enabled (issuer: {settings.oidc_issuer})")
|
|
else:
|
|
logger.info("OIDC authentication disabled - API is publicly accessible")
|