THREESCALE-11441 only validate oidc setting if authentication method is set to oidc by tkan145 · Pull Request #1568 · 3scale/APIcast

tkan145 · 2026-01-30T00:22:13Z

What

Fix https://issues.redhat.com/browse/THREESCALE-11441

Verification steps

Checkout this branch
Build APIcast image

make runtime-image IMAGE_NAME=apicast-test

Get into dev-environment

cd dev-environments/plain-http-upstream

Modify apicast-config.json as follow

diff --git a/dev-environments/plain-http-upstream/apicast-config.json b/dev-environments/plain-http-upstream/apicast-config.json
index ff944273..405498c6 100644                                                                                                 
--- a/dev-environments/plain-http-upstream/apicast-config.json                                                                  
+++ b/dev-environments/plain-http-upstream/apicast-config.json                                                                  
@@ -5,6 +5,7 @@                                                                                                                 
       "backend_version": "1",                                                                                                  
       "proxy": {                                                                                                               
         "hosts": ["get.example.com"],                                                                                          
+        "oidc_issuer_endpoint": "https://3scale-test:foo@rhsso.test/auth/realms/3scale", 
+        "authentication_method": "1", 
         "api_backend": "http://example.com/get",                                                                               
         "backend": {                                                                                                           
           "endpoint": "http://backend:80",

and docker-compose

diff --git a/dev-environments/plain-http-upstream/docker-compose.yml b/dev-environments/plain-http-upstream/docker-compose.yml
index ebf84ebc..0563effa 100644                                                                                               
--- a/dev-environments/plain-http-upstream/docker-compose.yml                                                                 
+++ b/dev-environments/plain-http-upstream/docker-compose.yml                                                                 
@@ -10,11 +10,11 @@ services:                                                                                                 
     - two.upstream                                                                                                           
     environment:                                                                                                             
       THREESCALE_CONFIG_FILE: /tmp/config.json                                                                               
-      THREESCALE_DEPLOYMENT_ENV: staging                                                                                     
-      APICAST_CONFIGURATION_LOADER: lazy                                                                                     
+      THREESCALE_DEPLOYMENT_ENV: production                                                                                  
+      APICAST_CONFIGURATION_LOADER: boot                                                                                     
       APICAST_WORKERS: 1                                                                                                     
       APICAST_LOG_LEVEL: debug                                                                                               
-      APICAST_CONFIGURATION_CACHE: "0"                                                                                       
+      APICAST_CONFIGURATION_CACHE: "300"                                                                                     
     expose:                                                                                                                  
       - "8080"                                                                                                               
       - "8090"

Start APIcast with latest image first,

make gateway IMAGE_NAME=quay.io/3scale/apicast:latest

the gateway should output the following

gateway-1  | 2026/01/30 00:13:53 [debug] 23#23: *2 [lua] http.lua:86: connect(): connected to  ip:172.19.0.2 host: keycloak port: 8080 ok: nil err: connection refused                                           
gateway-1  | 2026/01/30 00:13:53 [error] 23#23: *2 [lua] discovery.lua:113: openid_configuration(): failed to get OIDC Provider from http://oidc-issuer-for-3scale:oidc-issuer-for-3scale-secret@keycloak:8080/re
alms/basic/.well-known/openid-configuration status: 0 body: nil, context: ngx.timer                                                                                                                              
gateway-1  | 2026/01/30 00:13:53 [notice] 23#23: gracefully shutting down                                                                                                                                        
gateway-1  | 2026/01/30 00:13:53 [notice] 23#23: exiting

Stop the gateway

CTRL-C

Start the gateway again with new image

make  gateway IMAGE_NAME=apicast-test

Check the log again and you should not see the same error

josemigallas

LGTM with some minor suggestions

spec/configuration_loader/remote_v2_spec.lua

josemigallas · 2026-02-03T06:49:56Z

gateway/src/apicast/configuration_loader/oidc.lua

+    -- Only fetch OIDC configuration if authentication method is set to 'oidc'
+    local authentication = proxy.authentication_method or service.backend_version


I think this comment could go away by simply extracting a guard from the code below:

Suggested change

-- Only fetch OIDC configuration if authentication method is set to 'oidc'

local authentication = proxy.authentication_method or service.backend_version

local authentication = proxy.authentication_method or service.backend_version

if authentication ~= 'oidc' then

return nil

end

The if authentication part seems redundant anyway (nil is already unequal to 'oidc').

The authentication can take the following values:

1 : user_key

2: app_id/app_key

oidc: OIDC

nil: But if the oidc_issuer_endpoint is provided, then in this case we don't want to query OIDC endpoint
Therefore, an if statement is needed.

But is the first condition of the statement needed?

gateway/src/apicast/configuration_loader/oidc.lua

tkan145 requested a review from a team as a code owner January 30, 2026 00:22

tkan145 changed the title ~~fix: only validate oidc setting if authentication method is set to oidc~~ THREESCALE-11441 only validate oidc setting if authentication method is set to oidc Jan 30, 2026

tkan145 force-pushed the THREESCALE-11441 branch 2 times, most recently from 842cd5f to 2bd8459 Compare February 2, 2026 08:27

fix: only validate oidc setting if authentication method is set to oidc

121e6ef

tkan145 force-pushed the THREESCALE-11441 branch from 2bd8459 to 121e6ef Compare February 3, 2026 04:10

josemigallas reviewed Feb 3, 2026

View reviewed changes

Fix small typos

4d72b9b

josemigallas approved these changes Feb 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

THREESCALE-11441 only validate oidc setting if authentication method is set to oidc#1568

THREESCALE-11441 only validate oidc setting if authentication method is set to oidc#1568
tkan145 wants to merge 2 commits into3scale:masterfrom
tkan145:THREESCALE-11441

tkan145 commented Jan 30, 2026 •

edited

Loading

Uh oh!

josemigallas left a comment

Uh oh!

Uh oh!

josemigallas Feb 3, 2026

Uh oh!

tkan145 Feb 3, 2026 •

edited

Loading

Uh oh!

josemigallas Feb 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		-- Only fetch OIDC configuration if authentication method is set to 'oidc'
		local authentication = proxy.authentication_method or service.backend_version

Conversation

tkan145 commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Verification steps

Uh oh!

josemigallas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

josemigallas Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

tkan145 Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

josemigallas Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tkan145 commented Jan 30, 2026 •

edited

Loading

tkan145 Feb 3, 2026 •

edited

Loading