Implement workload identity token exchange

Signed-off-by: Ryan S <267728323+ironcommit@users.noreply.github.com>

Author: ironcommit

contrib/auth/authentik/.gitignore

@@ -0,0 +1 @@
+.generated/

contrib/auth/authentik/README.md

@@ -5,7 +5,7 @@ to verify three user-visible flows:
 
 - log in to NeMo with Authentik
 - call NeMo APIs through the Authentik gateway
-- run a NeMo job whose workload uses a real Authentik workload token
+- run a NeMo job whose workload exchanges a real Authentik workload subject token
 
 All credentials in this example are for local development only.
 
@@ -26,6 +26,30 @@ The stack seeds these local-only identities:
 - Workload identity: `svc-nemo`
 - Workload group: `nemo-editors`
 
+## Token Lifetime Knobs
+
+The demo exposes separate lifetime controls so refresh behavior can be tested
+without shortening the human CLI session:
+
+```bash
+export AUTHENTIK_NMP_WORKLOAD_IDENTITY_ACCESS_TOKEN_VALIDITY=seconds=90
+export AUTHENTIK_NMP_CLI_ACCESS_TOKEN_VALIDITY=hours=1
+export NMP_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS=120
+```
+
+`AUTHENTIK_NMP_WORKLOAD_IDENTITY_ACCESS_TOKEN_VALIDITY` is rendered into the
+Authentik workload OAuth provider. `AUTHENTIK_NMP_CLI_ACCESS_TOKEN_VALIDITY`
+is rendered into the CLI OAuth provider. `NMP_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS`
+is used by the Kubernetes demo for projected service account token
+`expirationSeconds` and by the Docker controller as a fallback refresh schedule
+when the demo issuer omits `expires_in`.
+
+Authentik 2024.12 issues the demo workload subject token, but it does not accept
+the RFC 8693 token exchange grant directly. The Compose stack therefore includes
+a demo-only `workload-token-exchange` service. The Docker backend refreshes the
+Authentik subject token file, the SDK posts that token to the broker, and the
+gateway trusts the broker JWKS for exchanged workload access tokens.
+
 ## Start The Stack
 
 From the repo root:
@@ -67,6 +91,11 @@ contrib/auth/authentik/run.sh test --lifecycle reuse
 contrib/auth/authentik/run.sh test --image registry.example.com/nemo/nmp-api:<tag>
 ```
 
+For a Kubernetes-hosted Authentik reference, see
+`contrib/auth/authentik/kubernetes/README.md`. That demo uses Kubernetes
+projected service account tokens as the workload subject token source instead
+of Docker's controller-managed secrets volume.
+
 Wait until the platform is ready through the gateway:
 
 ```bash
@@ -142,26 +171,6 @@ group can read the workspace from a job.
 export JOB_NAME=authentik-workload-demo
 ```
 
-Fetch a local demo token for the seeded workload identity:
-
-```bash
-export WORKLOAD_ACCESS_TOKEN="$(
-  curl -fsS http://127.0.0.1:18080/application/o/token/ \
-    -d grant_type=password \
-    -d client_id=nemo-platform \
-    -d client_secret=nemo-platform-secret-dev \
-    -d username=svc-nemo \
-    -d password=svc-nemo-token-secret-dev \
-    -d scope="openid email groups" \
-  | python -c 'import json, sys; print(json.load(sys.stdin)["access_token"])'
-)"
-```
-
-Keep this token in a non-reserved shell variable. Do not export it as
-`NEMO_WORKLOAD_TOKEN` in your shell. The NeMo CLI uses that variable as a
-runtime credential override, which would make later CLI commands run as the
-workload identity instead of `authentik-human`.
-
 Submit a job that runs the built-in hello-world workload auth task:
 
 ```bash
@@ -191,12 +200,6 @@ cat <<EOF | nemo --context authentik-human jobs create "$JOB_NAME" \
             ]
           }
         },
-        "environment": [
-          {
-            "name": "NEMO_WORKLOAD_TOKEN",
-            "value": "${WORKLOAD_ACCESS_TOKEN}"
-          }
-        ],
         "config": {"workspace": "${WORKSPACE}"}
       }
     ]
@@ -211,9 +214,17 @@ Watch it complete:
 nemo --context authentik-human jobs get-status "$JOB_NAME" --workspace "$WORKSPACE"
 ```
 
-Expected result: the job reaches `completed`. The workload exits successfully
-only after it uses the Authentik workload token to call NeMo through the gateway
-and retrieve the workspace.
+Expected result: the job reaches `completed`. The Docker jobs backend creates a
+dedicated workload identity volume, writes the current subject token to
+`/var/run/secrets/nemo-platform/workload/token`, injects
+`NMP_WORKLOAD_IDENTITY_TOKEN_FILE` with that path, and refreshes the file while
+the workload is running. The SDK reads that file and performs RFC 8693 token
+exchange before calling NeMo through the gateway.
+
+Do not include `NMP_WORKLOAD_IDENTITY_TOKEN_FILE`, `NEMO_WORKLOAD_TOKEN`, or
+`NEMO_WORKLOAD_TOKEN_FILE` in the job request. Managed job backends own those
+auth variables. The existing `/var/run/scratch/config` mount remains only for
+task configuration.
 
 Read the job logs:
 

contrib/auth/authentik/blueprints/nemo.yaml

@@ -53,6 +53,7 @@ entries:
       client_id: nemo-platform-cli
       sub_mode: user_username
       include_claims_in_id_token: true
+      access_token_validity: "hours=1"
       redirect_uris: []
       authorization_flow:
         !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
@@ -66,6 +67,29 @@ entries:
         - !Find [authentik_providers_oauth2.scopemapping, [scope_name, offline_access]]
         - !KeyOf nemo-groups-scope
 
+  - model: authentik_providers_oauth2.oauth2provider
+    id: nemo-workload-provider
+    identifiers:
+      name: nemo-platform-workload
+    attrs:
+      name: nemo-platform-workload
+      client_type: public
+      client_id: nemo-platform-workload
+      sub_mode: user_username
+      include_claims_in_id_token: true
+      access_token_validity: "minutes=5"
+      redirect_uris: []
+      authorization_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      signing_key:
+        !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+        - !KeyOf nemo-groups-scope
+
   - model: authentik_core.application
     identifiers:
       slug: nemo
@@ -82,6 +106,14 @@ entries:
       slug: nemo-cli
       provider: !KeyOf nemo-cli-provider
 
+  - model: authentik_core.application
+    identifiers:
+      slug: nemo-workload
+    attrs:
+      name: NeMo Platform Workload Identity
+      slug: nemo-workload
+      provider: !KeyOf nemo-workload-provider
+
   - model: authentik_core.group
     id: group-nemo-admins
     identifiers:

contrib/auth/authentik/blueprints/nemo.yaml.tpl

@@ -0,0 +1,181 @@
+# authentik blueprint: provision everything NeMo needs to use authentik as its
+# OIDC IdP, including a demo workload identity for gateway-verified auth.
+
+version: 1
+metadata:
+  name: nemo-platform-oidc
+  labels:
+    blueprints.goauthentik.io/description: "NeMo Platform OIDC provider + demo workload identity"
+
+entries:
+  - model: authentik_providers_oauth2.scopemapping
+    id: nemo-groups-scope
+    identifiers:
+      name: "NeMo groups"
+    attrs:
+      name: "NeMo groups"
+      scope_name: groups
+      description: "Comma-separated group membership used by the gateway workload header contract"
+      expression: |
+        return {"groups": ",".join(group.name for group in user.ak_groups.all())}
+
+  - model: authentik_providers_oauth2.oauth2provider
+    id: nemo-provider
+    identifiers:
+      name: nemo-platform
+    attrs:
+      name: nemo-platform
+      client_type: confidential
+      client_id: nemo-platform
+      client_secret: nemo-platform-secret-dev
+      sub_mode: user_username
+      include_claims_in_id_token: true
+      redirect_uris: []
+      authorization_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      signing_key:
+        !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, offline_access]]
+        - !KeyOf nemo-groups-scope
+
+  - model: authentik_providers_oauth2.oauth2provider
+    id: nemo-cli-provider
+    identifiers:
+      name: nemo-platform-cli
+    attrs:
+      name: nemo-platform-cli
+      client_type: public
+      client_id: nemo-platform-cli
+      sub_mode: user_username
+      include_claims_in_id_token: true
+      access_token_validity: "__AUTHENTIK_NMP_CLI_ACCESS_TOKEN_VALIDITY__"
+      redirect_uris: []
+      authorization_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      signing_key:
+        !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, offline_access]]
+        - !KeyOf nemo-groups-scope
+
+  - model: authentik_providers_oauth2.oauth2provider
+    id: nemo-workload-provider
+    identifiers:
+      name: nemo-platform-workload
+    attrs:
+      name: nemo-platform-workload
+      client_type: public
+      client_id: nemo-platform-workload
+      sub_mode: user_username
+      include_claims_in_id_token: true
+      access_token_validity: "__AUTHENTIK_NMP_WORKLOAD_IDENTITY_ACCESS_TOKEN_VALIDITY__"
+      redirect_uris: []
+      authorization_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      signing_key:
+        !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
+      property_mappings:
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, openid]]
+        - !Find [authentik_providers_oauth2.scopemapping, [scope_name, email]]
+        - !KeyOf nemo-groups-scope
+
+  - model: authentik_core.application
+    identifiers:
+      slug: nemo
+    attrs:
+      name: NeMo Platform
+      slug: nemo
+      provider: !KeyOf nemo-provider
+
+  - model: authentik_core.application
+    identifiers:
+      slug: nemo-cli
+    attrs:
+      name: NeMo Platform CLI
+      slug: nemo-cli
+      provider: !KeyOf nemo-cli-provider
+
+  - model: authentik_core.application
+    identifiers:
+      slug: nemo-workload
+    attrs:
+      name: NeMo Platform Workload Identity
+      slug: nemo-workload
+      provider: !KeyOf nemo-workload-provider
+
+  - model: authentik_core.group
+    id: group-nemo-admins
+    identifiers:
+      name: nemo-admins
+    attrs:
+      name: nemo-admins
+
+  - model: authentik_core.group
+    id: group-nemo-editors
+    identifiers:
+      name: nemo-editors
+    attrs:
+      name: nemo-editors
+
+  - model: authentik_core.user
+    id: nemo-user
+    identifiers:
+      username: nemo-user
+    attrs:
+      username: nemo-user
+      email: nemo-user@example.com
+      name: "NeMo CLI demo user"
+      password: nemo-user-password-dev
+      groups:
+        - !KeyOf group-nemo-editors
+
+  - model: authentik_core.token
+    identifiers:
+      identifier: nemo-user-token
+    attrs:
+      identifier: nemo-user-token
+      intent: app_password
+      user: !KeyOf nemo-user
+      key: nemo-user-token-secret-dev
+      expiring: false
+
+  - model: authentik_core.user
+    id: svc-nemo
+    identifiers:
+      username: svc-nemo
+    attrs:
+      username: svc-nemo
+      name: "NeMo demo workload identity"
+      type: service_account
+      path: service-accounts
+      groups:
+        - !KeyOf group-nemo-editors
+
+  - model: authentik_core.token
+    identifiers:
+      identifier: svc-nemo-token
+    attrs:
+      identifier: svc-nemo-token
+      intent: app_password
+      user: !KeyOf svc-nemo
+      key: svc-nemo-token-secret-dev
+      expiring: false
+
+  - model: authentik_brands.brand
+    identifiers:
+      domain: authentik-default
+    attrs:
+      default: true
+      flow_device_code:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]

contrib/auth/authentik/config/platform-compose-authentik.yaml

@@ -2,6 +2,8 @@ platform:
   runtime: "none"
   base_url: "http://0.0.0.0:8080"
   loopback_address: "nemo-gateway"
+  service_discovery:
+    files: "http://nemo-direct:8080"
 
 service: {}
 
@@ -23,6 +25,13 @@ auth:
     client_id: "nemo-platform-cli"
     token_endpoint: "http://127.0.0.1:18080/application/o/token/"
     device_authorization_endpoint: "http://127.0.0.1:18080/application/o/device/"
+    workload_token_exchange_enabled: true
+    workload_client_id: "nemo-platform-workload"
+    workload_token_endpoint: "http://workload-token-exchange:8080/application/o/token/"
+    workload_subject_token_type: "urn:ietf:params:oauth:token-type:jwt"
+    workload_requested_token_type: "urn:ietf:params:oauth:token-type:access_token"
+    workload_audience: "nemo-platform"
+    workload_scope: "openid email groups"
     subject_claim: "sub"
     email_claim: "email"
     groups_claim: "groups"
@@ -39,6 +48,13 @@ jobs:
       config:
         cleanup_completed_jobs_immediately: false
         launcher_tool_path: /tools/jobs-launcher
+        workload_identity:
+          enabled: true
+          token_endpoint: "http://authentik-server:9000/application/o/token/"
+          client_id: "nemo-platform-workload"
+          username: "svc-nemo"
+          password: "svc-nemo-token-secret-dev"
+          scope: "openid email groups"
   executor_defaults:
     docker:
       cleanup_completed_jobs_immediately: false