fix(hosted): publish eSignet discovery at its issuer origin - #32
Merged
Conversation
eSignet declares the bare public origin as its issuer but the Spring
service answers only under /v1/esignet, so routing the issuer host
straight at it left {issuer}/.well-known/openid-configuration and the
RFC 8414 authorization-server document unserved. No conformant client
could discover the provider.
The UI image already renders an nginx that publishes both documents at
the root, forwards /v1/esignet, and rewrites the upstream Host to the
issuer origin. Front the issuer origin with a second instance of it and
leave the service itself unrouted, which is how the surface was
published before the authority-cell reset.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
scripts/smoke-esignet.pyfails against the authority-cells fleet. eSignet declares its issuer as the bare public origin, but the Spring service answers only under/v1/esignet, so the reset's direct route to it leaves two required documents unserved:{issuer}/.well-known/openid-configuration→ 404{issuer}/.well-known/oauth-authorization-server→ 404No conformant OIDC client can discover the provider. The portal is unaffected only because it is hand-configured with explicit endpoints.
Cause
The reset (#23) reduced the eSignet app from seven services to five, removing
esignet-edge. That edge was what published the root discovery surface. Routing the issuer host straight at the Spring service dropped it.Fix
config/esignet/nginx-hosted.confalready publishes both documents at the root, forwards/v1/esignet, and rewrites the upstreamHostto the issuer origin so the backend emits the rightissuer. Front the issuer origin with a second instance of that image and leave the service itself unrouted, which is how the surface was published before the reset and how the superseded fleet still publishes it today.No new image:
esignet-edgereuses the already digest-pinnedSOLMARA_ESIGNET_UI_IMAGE.Verification
Both fleets probed live before the change:
esignethostesignethostesignet-uihost/.well-known/openid-configuration/.well-known/oauth-authorization-server/v1/esignet/oidc/.well-known/openid-configurationThe running UI container answers all three under either
Hostheader, confirming a second instance serves the issuer origin correctly.Tests written first; 112 hosted topology and provisioning tests green under
uv,scripts/check-coolify-compose.shclean.