feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods#6089

Merged

ntkathole merged 41 commits intofeast-dev:masterfrom

aniketpalu:oidc-support

Apr 7, 2026

Commits on Apr 6, 2026

feat: Extract groups and namespaces claims from JWT in OidcTokenParser

aniketpalu
authored and
ntkathole
committed
Minor formatting

aniketpalu
authored and
ntkathole
committed
feat: Allow Feast SDK to accept a pre-existing OIDC token without contacting the identity provider

aniketpalu
authored and
ntkathole
committed
fix: Raise error when configured token_env_var is empty

aniketpalu
authored and
ntkathole
committed
Minor formatting changes

aniketpalu
authored and
ntkathole
committed
Activate _check_mutually_exclusive groups only when all fields are set, reject stray auth_discovery_url/client_id without client_secret

aniketpalu
authored and
ntkathole
committed
Narrow OIDC client routing to use set-based key detection and extract _is_oidc_client_config helper

aniketpalu
authored and
ntkathole
committed
Fix .sort() assertions in test_token_parser.py that always compared None == None

aniketpalu
authored and
ntkathole
committed
Guard against missing roles key in resource_access to prevent unhandled KeyError

aniketpalu
authored and
ntkathole
committed
Fixed lint errors

aniketpalu
authored and
ntkathole
committed
Fixed lint error

aniketpalu
authored and
ntkathole
committed
Fixed lint errors

aniketpalu
authored and
ntkathole
committed
Added support to read ServiceAccount token and Minor improvements

aniketpalu
authored and
ntkathole
committed
Improved code readibility

aniketpalu
authored and
ntkathole
committed
Minor reformatting

aniketpalu
authored and
ntkathole
committed
fix: Use exact dict-key lookup for kubernetes.io claim to satisfy CodeQL substring sanitization check

aniketpalu
authored and
ntkathole
committed
feat: Add verify_ssl support to OIDC auth flow for self-signed certificates

aniketpalu
authored and
ntkathole
committed
feat: Lightweight SA token validation for OIDC auth — TokenReview only, no RBAC queries

aniketpalu
authored and
ntkathole
committed
Minor reformatting & lint related changes

aniketpalu
authored and
ntkathole
committed
Update sdk/python/feast/permissions/auth/oidc_token_parser.py

authored and
ntkathole
committed
fix: Restore missing return in intra-comm check and add error handling for K8s token validation

aniketpalu
authored and
ntkathole
committed
Minor reformatting

aniketpalu
authored and
ntkathole
committed
Checks preferred_username first (Keycloak default), then falls back to upn (Azure AD / Entra ID)

aniketpalu
authored and
ntkathole
committed
feat(operator): Split server/client OIDC config and add secretKeyName, tokenEnvVar, verifySSL CRD fields

aniketpalu
authored and
ntkathole
committed
Reverted kustomization.yaml

aniketpalu
authored and
ntkathole
committed
fix: Harden OIDC token parsing and make client_id optional

aniketpalu
authored and
ntkathole
committed
cache K8s client, eliminate double JWT decode, improve error messages

aniketpalu
authored and
ntkathole
committed
Minor formatting

aniketpalu
authored and
ntkathole
committed

Commits on Apr 7, 2026