OIDC proxy auth#1293

lets-call-n-walk · 2026-02-13T14:10:24Z

Summary

Adds optional OIDC proxy-based authentication to kagent, enabling integration with enterprise identity providers (Cognito, Okta, Dex, etc.) via an oauth2-proxy subchart.

When controller.auth.mode is set to "proxy", the controller trusts JWT tokens from the Authorization header injected by oauth2-proxy, extracting user identity from configurable JWT claims. When set to "unsecure" (the default), behavior is unchanged — no auth is required.

Note: This does not implement Access Control. It is purely the authentication mechanism. Access control is being discussed in this issue: #1270

What's included

Backend (Go)

ProxyAuthenticator that extracts user identity (email, name, groups) from JWT claims with configurable claim mapping
AUTH_MODE env var to switch between unsecure and proxy authentication at startup
/api/me endpoint returning the current user's identity from the auth context
Nil-safety fix for database manager shutdown

Frontend (Next.js)

AuthContext provider that decodes the JWT from the Authorization header and exposes user state
/login page with branded SSO redirect
UserMenu component showing current user info with sign-out
Auth header forwarding in all server actions and the A2A proxy route
jose dependency for client-side JWT decoding

Helm

oauth2-proxy subchart dependency (disabled by default)
controller.auth values for auth mode and JWT claim mapping
ui.auth.ssoRedirectPath for configurable SSO redirect
NetworkPolicy templates that lock down UI/controller access when auth is enabled
Custom oauth2-proxy templates for branded login redirect
NOTES.txt additions documenting auth configuration

How it works

Browser → oauth2-proxy → (OIDC flow with IdP) → Next.js UI → Go Controller
                ↓                                     ↓              ↓
         Session cookie                    AuthContext decodes   ProxyAuthenticator
         + JWT injection                   JWT for user state    extracts claims

NetworkPolicies ensure UI and controller only accept traffic from oauth2-proxy when auth mode is proxy.

Enabling

controller:
  auth:
    mode: proxy

oauth2-proxy:
  enabled: true
  extraEnv:
    - name: OIDC_ISSUER_URL
      value: "https://your-idp.example.com"
    - name: OIDC_REDIRECT_URL
      value: "https://kagent.example.com/oauth2/callback"

See docs/OIDC_PROXY_AUTH_ARCHITECTURE.md for full architecture details.

Introduces optional OIDC authentication via oauth2-proxy subchart. When controller.auth.mode is set to "proxy", the controller trusts JWT tokens from the Authorization header (set by oauth2-proxy) instead of the default unsecure X-User-Id header. Includes proxy authenticator, /api/me endpoint, auth header forwarding in UI server actions, AuthContext/login page in the frontend, network policies, and Helm configuration for oauth2-proxy integration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Collin Walker <cwalker@ancestry.com> Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

Copilot

Pull request overview

Adds an optional “OIDC proxy auth” mode to kagent, intended to run behind oauth2-proxy and derive user identity from a JWT in the Authorization header, while keeping the existing unauthenticated (“unsecure”) behavior as the default.

Changes:

Backend: introduce ProxyAuthenticator, extend Principal with identity fields, and add /api/me for current-user introspection.
Frontend: add auth header forwarding utilities, an AuthContext + UserMenu, and a branded /login page.
Helm: add optional oauth2-proxy subchart + templates, auth-related values/env wiring, and NetworkPolicies to restrict direct UI/controller access when auth is enabled.

Reviewed changes

Copilot reviewed 36 out of 38 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
ui/src/types/index.ts	Adjust UI request typing for session creation (removes `user_id` from request shape).
ui/src/lib/jwt.ts	JWT decode + claim extraction utilities for UI/server actions.
ui/src/lib/auth.ts	Centralized `Authorization` header extraction for server actions/route handlers.
ui/src/contexts/AuthContext.tsx	Client-side provider for “current user” state via a server action.
ui/src/components/chat/ChatInterface.tsx	Stops injecting `user_id` when creating sessions.
ui/src/components/UserMenu.tsx	Adds user dropdown with groups display + sign out.
ui/src/components/Header.tsx	Wires `UserMenu` into desktop/mobile header layouts.
ui/src/app/tools/page.tsx	Fixes import path to use app actions alias.
ui/src/app/servers/page.tsx	Fixes import path to use app actions alias.
ui/src/app/login/page.tsx	Adds branded login page with SSO redirect link.
ui/src/app/layout.tsx	Wraps app in `AuthProvider` and adjusts root layout hydration settings.
ui/src/app/actions/utils.ts	Stops appending `user_id` to backend requests; forwards `Authorization` instead.
ui/src/app/actions/feedback.ts	Removes `user_id` injection from feedback submission.
ui/src/app/actions/auth.ts	Adds server action to derive current user from incoming `Authorization` JWT.
ui/src/app/a2a/[namespace]/[agentName]/route.ts	Forwards auth header through the A2A proxy route.
ui/package.json	Adds `jose` dependency for JWT decoding.
helm/kagent/values.yaml	Adds controller/ui auth values, oauth2-proxy values, and networkPolicy values.
helm/kagent/templates/ui-deployment.yaml	Injects `SSO_REDIRECT_PATH` env var into UI deployment.
helm/kagent/templates/oauth2-proxy-templates.yaml	Adds custom oauth2-proxy template ConfigMap to redirect to `/login`.
helm/kagent/templates/networkpolicy.yaml	Adds NetworkPolicies to restrict ingress paths when proxy auth is enabled.
helm/kagent/templates/controller-deployment.yaml	Injects `AUTH_MODE` and JWT-claim env vars into controller when in proxy mode.
helm/kagent/templates/_helpers.tpl	Adds helper to conditionally enable NetworkPolicies when auth is enforced.
helm/kagent/templates/NOTES.txt	Documents NetworkPolicy behavior when enabled.
helm/kagent/Chart-template.yaml	Adds oauth2-proxy as an optional chart dependency.
go/test/e2e/auth_api_test.go	Adds E2E coverage for `/api/me` across auth modes.
go/pkg/auth/auth_test.go	Adds basic test for new `Principal` user/group fields.
go/pkg/auth/auth.go	Extends auth model with `Email`, `Name`, and `Groups`.
go/internal/httpserver/server.go	Adds `/api/me` route and nil-safety for DB manager shutdown.
go/internal/httpserver/handlers/handlers.go	Registers `CurrentUserHandler`.
go/internal/httpserver/handlers/current_user_test.go	Unit tests for `/api/me` handler behavior.
go/internal/httpserver/handlers/current_user.go	Implements `/api/me` handler using auth session principal.
go/internal/httpserver/auth/proxy_authn_test.go	Unit tests for JWT claim extraction + fallback behaviors.
go/internal/httpserver/auth/proxy_authn.go	Implements proxy-mode authenticator (JWT parsing + fallback).
go/cmd/controller/main.go	Selects authenticator based on `AUTH_MODE` at startup.
go/cmd/controller/auth_mode_test.go	Tests authenticator selection logic.
docs/OIDC_PROXY_AUTH_ARCHITECTURE.md	Adds architecture documentation for the proxy auth approach.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

peterj · 2026-02-16T20:46:15Z

+const SSO_REDIRECT_PATH = process.env.SSO_REDIRECT_PATH || "/oauth2/start";
+
+// Kagent logo SVG - extracted from official logo
+function KagentLogo({ size = 32 }: { size?: number }) {


there's a logo here -

kagent/ui/src/components/kagent-logo.tsx

Line 4 in 706a170

const blinkStyles = `

-- can that be re-used instead of creating a new one?

peterj · 2026-02-16T20:46:57Z

+
+      {/* CSS to hide header/footer and override main layout for fullscreen login */}
+      <style>{`
+        body:has(.login-page) > div header,


the project is using tailwind, can you convert this to tailwind classes instead?

peterj · 2026-02-16T20:47:57Z

+              <span>kagent</span>
+            </h1>
+            <p className="text-lg md:text-2xl text-gray-300 max-w-[600px] font-normal mb-10 leading-relaxed">
+              Orchestrating Your AI Future with Kubernetes and Beyond


since we have "Bringing Agentic AI to cloud native" on the website -- perhaps we do the same here?

peterj · 2026-02-16T20:51:53Z

+}
+
+export function extractUserFromClaims(claims: JWTPayload) {
+  return {


can we introduce a type for the { user, email, name, groups }?

peterj · 2026-02-16T20:54:50Z

+  return (
+    <>
+      {/* Preload background image for faster rendering */}
+      <link rel="preload" href="/login-bg.webp" as="image" type="image/webp" fetchPriority="high" />


if the jpg version of the file is not used, we should remove it from the /public folder

Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

EItanya

These changes are looking great! The 2 themes I wanna focus on first are the inclusion of NetworkPolicy and the way the claims are being parsed. Looking forward to more discussion and iteration!

Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

lets-call-n-walk · 2026-02-26T18:39:26Z

@EItanya @peterj let me know if this addresses your feedback, thanks!

EItanya

Overall the changes here make a lot of sense to me. Unfortunately the PR seems quite out of date so I'm having trouble gleaning what exactly is new and what isn't. Any chance you can update so I can look again?

EItanya · 2026-02-26T19:58:59Z

+	// Agents authenticate via user_id query param or X-User-Id header
+	userID := query.Get("user_id")
+	if userID == "" {
+		userID = reqHeaders.Get("X-User-Id")
+	}
+	if userID == "" {
+		return nil, ErrUnauthenticated
+	}
+
+	return &SimpleSession{
+		P: auth.Principal{
+			User: auth.User{
+				ID: userID,
+			},
+			Agent: auth.Agent{
+				ID: agentID,
+			},
+		},
+		authHeader: authHeader,
+	}, nil


We should probably create a follow-up for this to make sure it's more secure

EItanya · 2026-02-26T20:00:12Z

+		// Parse JWT without validation (oauth2-proxy or k8s service account already validated)
+		rawClaims, err := parseJWTPayload(tokenString)


Can we call this mode trusted-proxy instead of just proxy because it's explicitly not re-validating

Signed-off-by: Collin Walker <10523817+lets-call-n-walk@users.noreply.github.com>

Clarifies that this mode explicitly trusts the upstream proxy's JWT validation and does not re-validate tokens. Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

…/kagent into oidc-proxy-auth

lets-call-n-walk · 2026-03-02T21:34:23Z

@EItanya renamed proxy to trusted proxy. Most of the other comments were on code that wasn't mine, but the diff had gotten messed up from being behind - I merged and the diff is correct now.

jsonmp-k8 · 2026-03-20T05:44:31Z

 async function submitFeedback(feedbackData: FeedbackData): Promise<any> {
-    const userID = await getCurrentUserId();
-    const body = { 
+    const body = {


Removing user_id from this payload looks like a regression unless the backend now injects it from the auth session. HandleCreateFeedback still persists the request body verbatim, so database.Feedback.UserID is stored as empty here and ListFeedback(userID) will never return these rows.

jsonmp-k8 · 2026-03-20T05:44:31Z

+      value: ""
+    # Default assumes release name "kagent". Override if using different release name.
+    - name: UPSTREAM_URL
+      value: "http://kagent-ui:8080"


Hard-coding http://kagent-ui:8080 only works for the default release name. The chart templates the actual service name as {{ include "kagent.fullname" . }}-ui, so fullnameOverride or a non-default release name will break oauth2-proxy unless the user manually overrides UPSTREAM_URL.

jsonmp-k8 · 2026-03-20T05:44:31Z

@@ -165,10 +169,13 @@ func (cfg *Config) SetFlags(commandLine *flag.FlagSet) {

 	commandLine.Var(&cfg.Streaming.MaxBufSize, "streaming-max-buf-size", "The maximum size of the streaming buffer.")
 	commandLine.Var(&cfg.Streaming.InitialBufSize, "streaming-initial-buf-size", "The initial size of the streaming buffer.")
-	commandLine.DurationVar(&cfg.Streaming.Timeout, "streaming-timeout", 600*time.Second, "The timeout for the streaming connection.")
+	commandLine.DurationVar(&cfg.Streaming.Timeout, "streaming-timeout", 60*time.Second, "The timeout for the streaming connection.")


This changes the default streaming timeout from 10 minutes to 1 minute. A2ARegistrar wires this value straight into a2aclient.WithTimeout, so long-running streams and tool calls will now terminate after 60s unless the operator overrides the flag. Was that intentional for this auth PR?

jsonmp-k8 · 2026-03-20T05:44:32Z

+	}, nil
+}
+
+func (a *ProxyAuthenticator) UpstreamAuth(r *http.Request, session auth.Session, upstreamPrincipal auth.Principal) error {


This drops X-User-Id on controller-to-agent A2A calls. The downstream A2A runtimes still derive the caller from that header, so in trusted-proxy mode the real user becomes A2A_USER_<context_id> after the first hop. We likely need to forward the resolved user id here in addition to the bearer token.

jholt96 · 2026-03-23T10:53:04Z

I did have an alternative approach here just looking at headers. You can set an env var on kagent like TRUSTED_USER_HEADERS and specify the headers to look at. AWS ALB and oauth2 proxy will give you a header with a User ID in it that you can use. kagent can be configured to use given header(s) as the user ID if detected. I think it's simpler (doesn't require JWT parsing) and also supports more reverse proxies (ones that don't use JWT)

The reason why JWTs are desired is so that the organization can give more data than just USER_ID, such as groups. Then that JWT can be passed to an RBAC service (which is also being worked on), and used to verify permissions for said user. (which would then start to address the first concern of allowing users to share sessions.).

In addition to the reason above, passing JWT directly also allows for supporting user identity propagation to downstream services. Some enterprise Cyber practices don't like OBO and prefer propagation. I think it's great to be able to support both with kagent directly being able to propagate identity, and then having agent gateway integration for OBO and more fine-grained control.

github-actions · 2026-04-08T10:24:16Z

This pull request has been marked as stale because of no activity in the last 15 days. It will be closed in the next 5 days unless it is tagged "no stalebot" or other activity occurs.

christensenjairus · 2026-04-08T16:10:20Z

This pull request has been marked as stale because of no activity in the last 15 days. It will be closed in the next 5 days unless it is tagged "no stalebot" or other activity occurs.

Not stale! Would love to see this completed

jholt96 · 2026-04-08T16:25:43Z

This is a must have for the project! Please let me know what is needed to get this merged. Happy to assist @lets-call-n-walk @EItanya

Resolves conflicts from Go directory restructuring (go/ → go/core/), Helm controller deployment env vars, values.yaml, and UI package versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ream URL - Reject unknown auth modes at startup instead of silently falling back to unsecure; fix help text to document "trusted-proxy" (not "proxy") - Populate feedback UserID from auth context in HandleCreateFeedback so records are queryable by ListFeedback - Add CurrentUser handler to Handlers struct for /api/me endpoint - Strengthen oauth2-proxy UPSTREAM_URL comment re: release name dependency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Collin Walker <cw404@hotmail.com>

lets-call-n-walk · 2026-04-08T17:07:47Z

@EItanya @jsonmp-k8 updated per review and fixed merge conflicts

- Add jose to package-lock.json (was missing, breaking all UI/Docker builds) - Fix gofmt formatting in server.go and app.go (spaces -> tabs) - Replace untyped CurrentUser alias with interface defining well-known OIDC claim fields (sub, name, email, groups, preferred_username) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

EItanya · 2026-04-09T01:13:21Z

Hey there, sorry for the delay, I updated the PR so it should now pass in CI. I will do a final review tomorrow

The PR changed the lazy initializer pattern to useState(null) + useEffect, which triggers the no-setState-in-effect ESLint rule. Restore the original lazy initializer while keeping the pathname-based login page guard. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

The Header component now renders UserMenu which requires AuthContext. Add AuthProvider decorator to Header stories to fix storybook tests. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Without this, downstream A2A runtimes fall back to deriving the caller identity from the context ID (`A2A_USER_<contextID>`) instead of the real authenticated user, because `UserIDCallInterceptor` reads `X-User-Id` rather than the forwarded `Bearer` token. Mirrors the behaviour of [`UnsecureAuthenticator.UpstreamAuth`](https://github.com/kagent-dev/kagent/blob/b50661f858787f6c4de2a73479f492ba82af6ca4/go/core/internal/httpserver/auth/authn.go#L48) which already sets this header. Addresses kagent-dev#1293 (comment)

Without this, downstream A2A runtimes fall back to deriving the caller identity from the context ID (`A2A_USER_<contextID>`) instead of the real authenticated user, because `UserIDCallInterceptor` reads `X-User-Id` rather than the forwarded `Bearer` token. Mirrors the behaviour of [`UnsecureAuthenticator.UpstreamAuth`](https://github.com/kagent-dev/kagent/blob/b50661f858787f6c4de2a73479f492ba82af6ca4/go/core/internal/httpserver/auth/authn.go#L48) which already sets this header. Addresses kagent-dev#1293 (comment) Signed-off-by: Brian Fox <878612+onematchfox@users.noreply.github.com>

…1775) Ensures that caller identity correctly propagates from controller->agent->controller. Addresses #1293 (comment) and potentially also #1771 --------- Signed-off-by: Brian Fox <878612+onematchfox@users.noreply.github.com> Co-authored-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io> Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io>

lets-call-n-walk force-pushed the oidc-proxy-auth branch from f8b5fb5 to b608370 Compare February 13, 2026 15:28

lets-call-n-walk force-pushed the oidc-proxy-auth branch from b608370 to fcb1244 Compare February 13, 2026 15:56

lets-call-n-walk marked this pull request as ready for review February 13, 2026 16:11

lets-call-n-walk requested review from EItanya, ilackarms and yuval-k as code owners February 13, 2026 16:12

Copilot AI review requested due to automatic review settings February 13, 2026 16:12

lets-call-n-walk requested a review from peterj as a code owner February 13, 2026 16:12

Copilot started reviewing on behalf of lets-call-n-walk February 13, 2026 16:12 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

peterj reviewed Feb 16, 2026

View reviewed changes

EItanya mentioned this pull request Feb 17, 2026

[FEATURE] User RBAC Authorization for Kagent #1270

Open

3 tasks

lets-call-n-walk force-pushed the oidc-proxy-auth branch from 9129572 to 989f6ed Compare February 19, 2026 18:36

review fixes

c719dc1

Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

lets-call-n-walk force-pushed the oidc-proxy-auth branch from 989f6ed to c719dc1 Compare February 19, 2026 19:07

EItanya requested changes Feb 19, 2026

View reviewed changes

Comment thread helm/kagent/values.yaml Outdated

Comment thread go/internal/httpserver/auth/proxy_authn.go Outdated

Comment thread go/cmd/controller/main.go Outdated

Comment thread go/internal/httpserver/handlers/current_user.go Outdated

remove network policies, claim mapping, use config

852f6ae

Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

lets-call-n-walk requested review from EItanya and peterj February 24, 2026 14:54

EItanya reviewed Feb 26, 2026

View reviewed changes

lets-call-n-walk and others added 3 commits March 2, 2026 16:04

Merge branch 'main' into oidc-proxy-auth

2ebddb4

Signed-off-by: Collin Walker <10523817+lets-call-n-walk@users.noreply.github.com>

rename auth mode from "proxy" to "trusted-proxy"

571a9a1

Clarifies that this mode explicitly trusts the upstream proxy's JWT validation and does not re-validate tokens. Signed-off-by: Collin Walker <lets-call-n-walk@users.noreply.github.com>

Merge branch 'oidc-proxy-auth' of https://github.com/lets-call-n-walk…

101cc50

…/kagent into oidc-proxy-auth

jsonmp-k8 reviewed Mar 20, 2026

View reviewed changes

github-actions Bot added the stale This issue or PR has become stale label Apr 8, 2026

lets-call-n-walk and others added 2 commits April 8, 2026 12:30

Merge upstream/main into oidc-proxy-auth

7718e51

Resolves conflicts from Go directory restructuring (go/ → go/core/), Helm controller deployment env vars, values.yaml, and UI package versions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lets-call-n-walk force-pushed the oidc-proxy-auth branch from 3b67c92 to 839a797 Compare April 8, 2026 17:07

EItanya and others added 2 commits April 8, 2026 20:26

Merge branch 'main' into oidc-proxy-auth

477a50c

EItanya and others added 2 commits April 9, 2026 01:17

github-actions Bot removed the stale This issue or PR has become stale label Apr 9, 2026

EItanya approved these changes Apr 9, 2026

View reviewed changes

EItanya merged commit e372846 into kagent-dev:main Apr 9, 2026
22 checks passed

BrewTestBot mentioned this pull request Apr 22, 2026

kagent 0.9.0 Homebrew/homebrew-core#278973

Merged

onematchfox mentioned this pull request Apr 29, 2026

fix: ensure user identity is propagated across A2A requests/sessions #1775

Merged

		// Parse JWT without validation (oauth2-proxy or k8s service account already validated)
		rawClaims, err := parseJWTPayload(tokenString)

Conversation

lets-call-n-walk commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

How it works

Enabling

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

EItanya left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lets-call-n-walk commented Feb 26, 2026

Uh oh!

EItanya left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lets-call-n-walk commented Mar 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jholt96 commented Mar 23, 2026

Uh oh!

github-actions Bot commented Apr 8, 2026

Uh oh!

christensenjairus commented Apr 8, 2026

Uh oh!

jholt96 commented Apr 8, 2026

Uh oh!

lets-call-n-walk commented Apr 8, 2026

Uh oh!

EItanya commented Apr 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

lets-call-n-walk commented Feb 13, 2026 •

edited

Loading