Skip to content

Conversation

@peterpeterparker
Copy link
Contributor

Motivation

I should have thought about it when I introduced GitHub login: we do not want the enum to be called GitHub but, something else e.g. GitHubAuth or GitHubProxy, because we might use also other official JWT generated by GitHub such as those for actions #2539.

While it's not used yet in the Satellite and would not be an issue, it's already live in the Console and few users (not much like 4 at this time) have created an account with it means, in stable memory we have "GitHub" that is saved. I can potentially migrate those data but, to some extent, it's kind of correct to have such a field in memory. Plus using serde I could potentially live with it.

But, in the other hand, if we introduce additional providers for Jwt, we might not want to have all those providers being accepted for completing an authentication and signing a delegation. Typically in #2539 that's not the case.

Finally, the observatory must be able to fetch jwks certificate for any of the providers.

Long story short, the idea is to have an enum OpenIdProvider that contains all the provider but, separate providers for saving data in the state as e.g. OpenIdDelegationProvider introduced here.

We rename GitHub to GitHubAuth in OpenIdProvider that's a breaking changes that affect the cache of certificates and configuration of the Console but, we declare OpenIdDelegationProvider with Google and GitHub as enum value so this field is backwards compatible.

@peterpeterparker peterpeterparker merged commit c186cec into main Jan 28, 2026
21 checks passed
@peterpeterparker peterpeterparker deleted the feat/open-id-provider branch January 28, 2026 20:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants