Skip to content

Add defang identity: agent public-key registration - #2167

Draft
defangdevs wants to merge 1 commit into
DefangLabs:mainfrom
defangdevs:identity-register
Draft

Add defang identity: agent public-key registration#2167
defangdevs wants to merge 1 commit into
DefangLabs:mainfrom
defangdevs:identity-register

Conversation

@defangdevs

@defangdevs defangdevs commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Draft implementation for #2166 — CLI half of the agent-identity key registry (DefangLabs/openauth PR 8): agents hold a local keypair and register only the public half with the per-tenant OIDC registry, then federate into clouds with self-signed JWTs instead of long-lived credentials.

What's added

  • defang identity register — generates an RS256 keypair on first use (private key stays in <state-dir>/identity/<tenant>/<project>/<stack>/private.pem, mode 0600, one key per pair because the registry rejects cross-stack key reuse), signs the proof-of-possession JWT, and POSTs the public JWK to https://<tenant>.<issuer-host>/keys. Project and stack come from the normal session machinery (no cloud-provider auth needed, so CheckAccountInfo is off); the bearer is the OpenAuth token saved by defang login; the issuer comes from DEFANG_ISSUER.
  • defang identity list / defang identity revoke KID — the GET/DELETE endpoints.
  • pkg/identity — keypair handling (RS256: AWS OIDC federation doesn't accept Ed25519) and the registry HTTP client. RFC 7638 thumbprint via go-jose (promoted indirect → direct; no new deps), PoP JWT via the existing golang-jwt/v5.
  • pkg/http/delete.go — DeleteWithHeader/DeleteWithAuth, mirroring the existing GET helpers.
  • auth.Client.Issuer() accessor so the tenant URL can be derived without re-reading the env var.

Verification

  • go test -short ./... green; golangci-lint run clean on all touched packages.
  • Live end-to-end against the spike registry (tenant1.auth-spike.nixos.defang.ca): register → kid/sub returned, idempotent re-register, same-key-different-stack rejected with 409, list, revoke — all through the new pkg/identity client.

Why draft

Gated on the openauth side: PR 8 landing and the tenant-enabled issuer being deployed at auth.defang.io. Open questions from #2166 also apply (should /keys require a scoped token rather than the plain login token; identity rotate convenience).

🤖 Generated with Claude Code

https://claude.ai/code/session_01R9PbZ9nkj1RxubjnxujXPa

@defangdevs @claude
Add defang identity: agent public-key registration
6d84ef2 
New command group for the agent-identity key registry (OpenAuth as a
per-tenant OIDC public-key registry, DefangLabs/openauth PR 8):

- defang identity register: generate an RS256 keypair (private key
  stays under the state dir, one key per tenant/project/stack), sign
  the proof-of-possession JWT, and POST the public JWK to the tenant
  registry
- defang identity list / revoke: manage registered keys

pkg/identity owns keypair handling and the registry HTTP client; the
bearer token is the OpenAuth access token saved by defang login, and
the tenant URL is derived from DEFANG_ISSUER + the WhoAmI tenant label.
go-jose (already indirect) is promoted to direct for JWK marshaling and
the RFC 7638 thumbprint.

Verified end-to-end against the live spike registry: register,
idempotent re-register, cross-stack key-reuse 409, list, revoke.

Addresses issue 2166.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R9PbZ9nkj1RxubjnxujXPa
@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7204e5d1-68d5-41ba-9978-8ea35e850e85

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@lionello
lionello requested a review from raphaeltm July 18, 2026 09:38
@lionello lionello added the spike Spike; do not merge label Aug 13, 2026
@defangdevs defangdevs mentioned this pull request Aug 14, 2026
Merged
@defangdevs

defangdevs commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Picking up the other halves of this spike (registry: DefangLabs/portal#1011, Fabric: DefangLabs/defang-mvp#3174) turned up a break in this branch worth fixing before it comes out of draft.

identity.TenantURL(issuer, GetTenantName()) builds a URL that cannot resolve. GetTenantName() returns types.TenantLabel — Fabric's own DNS-safe label from utils.NewTenantLabel() ("t"+RandomID()), whose mapping to a tenant ID lives only in Fabric's Redis (cache.PutTenantID). The registry runs in Portal and resolves the Portal tenant UUID; it has never seen a Fabric label, so t9wruioqk2n7.auth.defang.io resolves to nothing there.

The fix is not to swap in TenantId client-side either — that would freeze the URL shape into every released binary. Fabric now reports the URL directly: WhoAmIResponse.identity_issuer (proto in #2208, filled in by DefangLabs/defang-mvp#3174). Once #2208 lands, identityRegistryClient should read it from WhoAmI and error out with something actionable when it is empty (deployment serves no registry) instead of calling TenantURL.

Two smaller notes for the same pass:

  • The registry keys the private key directory by tenant. With the issuer URL coming from WhoAmI, the tenant UUID is the stable identifier for IdentityKeyDir, not the label — worth switching so keys survive a label change.
  • The open question in CLI: agent public-key registration against the agent-identity registry (defang identity) #2166 about /keys accepting a plain login token: the registry as implemented takes the ordinary access token and checks tenant membership server-side (owner, tenantMembers, or externalTenants), matching /userinfo. A dedicated scope stays a tightening we can add later without a client change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@raphaeltm raphaeltm Awaiting requested review from raphaeltm
@lionello lionello Awaiting requested review from lionello lionello will be requested when the pull request is marked ready for review lionello is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

spike Spike; do not merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@defangdevs @lionello