Add verified JWT edge assertions via JWKS#52
Merged
czpython merged 1 commit intoJul 23, 2026
Merged
Conversation
czpython
force-pushed
the
commonzenpython/eng-730-edge-identity-headernone-door-cutover-onboarding-deploy
branch
3 times, most recently
from
July 23, 2026 20:44
340cc9f to
a8a25bb
Compare
czpython
force-pushed
the
commonzenpython/eng-730-edge-identity-headernone-door-cutover-onboarding-deploy
branch
2 times, most recently
from
July 23, 2026 20:48
8bce775 to
150883b
Compare
Base automatically changed from
commonzenpython/eng-730-edge-identity-headernone-door-cutover-onboarding-deploy
to
main
July 23, 2026 20:51
czpython
force-pushed
the
commonzenpython/eng-732-edge-identity-verified-jwt-edge-assertions-via-jwks-pr-3
branch
from
July 23, 2026 21:01
520dd9a to
5049db9
Compare
czpython
force-pushed
the
commonzenpython/eng-732-edge-identity-verified-jwt-edge-assertions-via-jwks-pr-3
branch
from
July 23, 2026 21:27
5049db9 to
9a17f5f
Compare
czpython
deleted the
commonzenpython/eng-732-edge-identity-verified-jwt-edge-assertions-via-jwks-pr-3
branch
July 23, 2026 21:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third auth mode for the edge-identity arc:
DRUKS_AUTH_MODE=jwtverifies an edge-signed assertion carried inDRUKS_AUTH_HEADER— RS256 against the edge's published JWKS (five-minute key cache, refetch on rotation), pinnediss/aud/exp, and the verified identity claim (defaultemail) mapped through the same open-enrollment path header mode uses. Verification fails closed with a typed error naming only the failure class; the raw token never reaches an error or log. Bearer PATs still resolve first and theAuthorizationslot stays PAT-only.Part of ENG-732 (edge-identity arc, PR 3 of 3; stacked on #51).
The pinned JWT profile (RS256, required iss/aud/exp, email claim) must be confirmed against the first real provider before the mode is enabled anywhere — tracked as the ticket's standing caveat.
🤖 Generated with Claude Code