Phase 1, kafka, oauth, saml mdq validation.

[masv3971]

No description provided.

[Copilot]

Pull request overview

This PR advances “Phase 1” hardening across OAuth, Kafka, and SAML by adding private_key_jwt client assertion verification support, introducing Kafka SASL/mTLS configuration knobs, and enforcing safer SAML metadata handling, while also reducing sensitive log output.

Changes:

• Add RFC 7523 client_assertion verification (JWKS fetch + JWT validation) and wire it into the token endpoint flow.
• Extend configuration to support Kafka SASL + mTLS and tighten TLS config validation semantics.
• Enforce signature requirements for MDQ/URL SAML metadata (with an explicit insecure override) and reduce sensitive logging.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/oauth2/clients.go	Adds jwks_uri to client config to support private_key_jwt verification.
pkg/oauth2/client_assertion_verifier.go	New verifier implementation for RFC 7523 client assertions using JWKS + JWT validation.
pkg/oauth2/client_assertion_verifier_test.go	Unit tests covering verifier success/failure cases.
pkg/model/config.go	Adds MTLS + Kafka SASL settings; adjusts TLS required-when-enabled semantics; adds SAML unsigned-metadata override flag.
pkg/messagebroker/kafka/security.go	New helper applying SASL/TLS/mTLS settings to Sarama config.
pkg/messagebroker/kafka/scram.go	SCRAM client implementation for Sarama via xdg-go/scram.
pkg/messagebroker/kafka/scram_test.go	Tests for SCRAM helpers/client behavior.
pkg/messagebroker/kafka/producer.go	Uses shared security config application for producer.
pkg/messagebroker/kafka/consumer.go	Uses shared security config application for consumer.
internal/verifier/apiv1/handlers_verification.go	Reduces sensitive debug logging (no longer logs full request/JWT/VP response).
internal/apigw/auth_providers/samlsp/service.go	Enforces metadata signature verification for MDQ/URL sources unless explicitly overridden; adds warnings for insecure paths.
internal/apigw/apiv1/handlers_oauth.go	Replaces “unverified assertion” TODO path with RFC 7523 verification when unverified mode is off.
.vscode/settings.json	Adds spellchecker allowlist entries for new terms.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 7 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 1 comment.

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.