Skip to content

Auth: implement OAuth2 Client Credentials flow identity provider - #469

Closed
rayl15 wants to merge 2 commits into
agntcy:mainfrom
rayl15:feature/oauth2-client-credentials-400
Closed

rayl15 wants to merge 2 commits into
agntcy:mainfrom
rayl15:feature/oauth2-client-credentials-400

Conversation

@rayl15

@rayl15 rayl15 commented Jul 27, 2025 •

Copy link
Copy Markdown
Contributor

Description

This PR implements the OAuth2 Client Credentials flow identity provider as requested in issue #400. The implementation provides both TokenProvider and Verifier traits support with comprehensive token caching and error handling.

Core Implementation

  • OAuth2TokenProvider: Implements TokenProvider trait with client_id/client_secret authentication
  • OAuth2Verifier: Implements Verifier trait leveraging existing JWT infrastructure
  • Thread-safe token caching with configurable buffer time for automatic renewal
  • Form-encoded requests following RFC 6749 OAuth2 standard
  • Integration with existing JwtBuilder pattern for seamless adoption

Files Modified

  • data-plane/core/auth/src/oauth2.rs - New OAuth2 implementation (704 lines)
  • data-plane/core/auth/src/errors.rs - Added OAuth2-specific error types
  • data-plane/core/auth/src/lib.rs - Added module exports for easy access
  • data-plane/core/auth/src/builder.rs - Extended builder pattern for OAuth2 support

Testing

All tests pass with comprehensive coverage:

cargo test oauth2 --lib
# running 13 tests
# test result: ok. 13 passed; 0 failed; 0 ignored

Test scenarios include:

  • Token acquisition and caching
  • Error handling (401, 500, timeouts, malformed responses)
  • Token expiration and renewal
  • Concurrent request handling
  • Configuration validation

Usage Example

use slim_auth::{OAuth2ClientCredentialsConfig, OAuth2TokenProvider, TokenProvider};

let config = OAuth2ClientCredentialsConfig {
    client_id: "my-client".to_string(),
    client_secret: "my-secret".to_string(),
    token_endpoint: "https://auth.example.com/oauth/token".to_string(),
    scope: Some("api:read".to_string()),
    audience: Some("https://api.example.com".to_string()),
    cache_buffer: Some(Duration::from_secs(300)),
    timeout: Some(Duration::from_secs(30)),
};

let provider = OAuth2TokenProvider::new(config)?;
let token = provider.get_token_async().await?;

Type of Change

  • Bugfix
  • New Feature
  • Breaking Change
  • Refactor
  • Documentation
  • Other (please describe)

Checklist

  • I have read the contributing guidelines
  • Existing issues have been referenced (where applicable)
  • I have verified this change is not present in other open pull requests
  • Functionality is documented
  • All code style checks pass
  • New code contribution is covered by automated tests
  • All new and existing tests pass

Fixes: #400

Add OAuth2 Client Credentials flow implementation with TokenProvider and
Verifier traits support. Includes token caching, automatic renewal, and
comprehensive error handling.

Features:
- OAuth2TokenProvider implementing TokenProvider trait
- OAuth2Verifier leveraging existing JWT infrastructure
- Thread-safe token caching with configurable buffer time
- Form-encoded requests following RFC 6749 standard
- Integration with existing JwtBuilder pattern
- 13 comprehensive unit tests covering all scenarios

The implementation supports client_id/client_secret authentication,
automatic token renewal, and public key resolution for verification.

Fixes: agntcy#400
Signed-off-by: Rahul Sharma <er.csrahul@gmail.com>
@rayl15
rayl15 requested a review from a team as a code owner July 27, 2025 19:13
Apply cargo fmt to fix trailing spaces and line formatting
issues identified by CI lint checks.

No functional changes, only formatting improvements.

Signed-off-by: Rahul Sharma <er.csrahul@gmail.com>
@amitami2

Copy link
Copy Markdown
Contributor

@rayl15 there is already an opened PR for this :
#464

@rayl15 rayl15 closed this Aug 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Implement OAuth2 Client Credentials flow identity provider

2 participants