feat(auth): add idp reference contract scaffolding

Signed-off-by: Ryan S <267728323+ironcommit@users.noreply.github.com>

Author: ironcommit

.github/actions/changes/action.yaml

@@ -43,6 +43,9 @@ outputs:
   cpu-smoke:
     description: "'true' if CPU smoke image or Kubernetes smoke test inputs changed"
     value: ${{ steps.filter.outputs.deps == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.docker-scripts == 'true' || steps.filter.outputs.helm == 'true' || steps.filter.outputs.openapi == 'true' || steps.filter.outputs.python-runtime == 'true' || steps.filter.outputs.web-studio == 'true' || steps.filter.outputs.k8s-smoke == 'true' }}
+  auth-idp:
+    description: "'true' if auth-idp tests or their containerized E2E harness inputs changed"
+    value: ${{ steps.filter.outputs.auth-idp == 'true' }}
 
 runs:
   using: "composite"
@@ -97,3 +100,7 @@ runs:
             - 'e2e/k8s/values/**'
             - 'e2e/test_jobs.py'
             - '.github/actions/free-disk-space/action.yaml'
+          auth-idp:
+            - 'tests/auth_idp/**'
+            - 'e2e/**'
+            - 'contrib/auth/authentik/**'

.github/workflows/ci.yaml

@@ -44,6 +44,7 @@ jobs:
       docker: ${{ steps.changes.outputs.docker }}
       helm: ${{ steps.changes.outputs.helm }}
       cpu-smoke: ${{ steps.changes.outputs.cpu-smoke }}
+      auth-idp: ${{ steps.changes.outputs.auth-idp }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/changes
@@ -101,7 +102,8 @@ jobs:
     if: >
       !cancelled() && (
         github.event_name == 'workflow_dispatch' ||
-        needs.changes.outputs.cpu-smoke == 'true'
+        needs.changes.outputs.cpu-smoke == 'true' ||
+        needs.changes.outputs.auth-idp == 'true'
       )
     runs-on: ubuntu-latest
     timeout-minutes: 90
@@ -908,6 +910,59 @@ jobs:
             coverage.xml
             coverage.json
 
+  python-auth-idp-test:
+    name: Python auth-idp tests
+    needs: [changes, policy-wasm, build-cpu-smoke-images]
+    if: >
+      !cancelled() && (
+        github.event_name == 'workflow_dispatch' ||
+        needs.changes.outputs.cpu-smoke == 'true' ||
+        needs.changes.outputs.auth-idp == 'true'
+      ) &&
+      needs.build-cpu-smoke-images.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Free disk space
+        uses: ./.github/actions/free-disk-space
+      - name: Download policy WASM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: policy-wasm
+          path: services/core/auth/src/nmp/core/auth/assets
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          python-version: "3.11"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Log in to GHCR
+        if: needs.build-cpu-smoke-images.outputs.publish_images == 'true'
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Run auth-idp tests
+        run: make test-auth-idp
+        env:
+          _TYPER_FORCE_DISABLE_TERMINAL: "1"
+          E2E_SERVICES_LOG_DIR: ${{ runner.temp }}/e2e-services-logs
+          IMAGE_REGISTRY: ${{ needs.build-cpu-smoke-images.outputs.image_registry }}
+          BAKE_TAG: ${{ needs.build-cpu-smoke-images.outputs.image_tag }}
+      - name: Upload test artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-auth-idp-test-results
+          retention-days: 30
+          path: |
+            ${{ runner.temp }}/e2e-services-logs/
+
   # Build wheels for all packages × python versions. Downstream jobs
   # (wheel-test, python-e2e-test) download these artifacts instead
   # of rebuilding.

Makefile

@@ -122,6 +122,13 @@ docs-watch: ## Start Fern docs dev plus a repo-level watcher for docs/** changes
 docs-check: ## Validate the Fern docs (fern check + validate-mdx + gated-link check)
 	cd docs/fern && npm run check
 
+.PHONY: test-auth-idp
+test-auth-idp: ## Run the auth-idp test suite
+	uv run --frozen pytest tests/auth_idp -v
+
+.PHONY: test-auth-idp-matrix
+test-auth-idp-matrix: test-auth-idp ## Backward-compatible alias for auth-idp suite
+
 .PHONY: docs-check-python-snippets
 docs-check-python-snippets: ## Syntax-check and type-check Python snippets in one doc (DOCS_PATH=...)
 	@if [ -z "$(strip $(DOCS_PATH))" ]; then echo "Usage: make docs-check-python-snippets DOCS_PATH=docs/customizer/tutorials/import-hf-model.mdx" >&2; exit 2; fi

conftest.py

@@ -18,6 +18,7 @@
 import pytest
 from nmp.testing.pytest_outcomes import pytest_skip as skip_test
 
+from tests.auth_idp.xdist import append_xdist_group_suffix
 from tests.discovery_exclusions import TEST_DISCOVERY_EXCLUSIONS
 
 # Set test environment variables BEFORE any imports
@@ -211,6 +212,7 @@ def pytest_collection_modifyitems(config, items):
     category_markers = {
         "unit",
         "e2e",
+        "auth_idp",
         "smoke_gpu_tasks",
         "smoke_nmp_automodel_tasks",
         "smoke_nmp_automodel_training",
@@ -247,6 +249,13 @@ def pytest_collection_modifyitems(config, items):
         if not marker_names.intersection(category_markers):
             item.add_marker(pytest.mark.unit)
 
+        if getattr(config.option, "numprocesses", None) or getattr(config, "workerinput", None) is not None:
+            group_names = set()
+            for mark in item.iter_markers("xdist_group"):
+                name = mark.args[0] if mark.args else mark.kwargs.get("name", "default")
+                group_names.add(str(name))
+            item._nodeid = append_xdist_group_suffix(item.nodeid, group_names)
+
 
 # ============================================================================
 # Pytest command-line options
@@ -295,6 +304,7 @@ def pytest_runtest_setup(item):
             skip_test("Skipping container-only test (requires NMP_BASE_URL)")
 
 
+from xdist.scheduler.loadgroup import LoadGroupScheduling  # noqa: E402
 from xdist.scheduler.loadscope import LoadScopeScheduling  # noqa: E402
 
 # Temporary workaround for https://github.com/pytest-dev/pytest-xdist/issues/1189
@@ -310,3 +320,7 @@ def _patched_reschedule(self, node):
 
 
 LoadScopeScheduling._reschedule = _patched_reschedule  # type: ignore[invalid-assignment]
+
+
+def pytest_xdist_make_scheduler(config, log):
+    return LoadGroupScheduling(config, log)

contrib/auth/README.md

@@ -0,0 +1,17 @@
+# Identity Provider References
+
+This directory contains NeMo Platform identity-provider reference bundles.
+
+Each provider bundle defines one contract for local validation and production
+adaptation:
+
+- expose OIDC discovery metadata
+- include a gateway layer that strips inbound `X-NMP-Principal-*` headers
+- define one human identity and one machine identity for shared auth testing
+- treat external machine identities as ordinary OIDC principals authorized by
+  group binding, not as internal `service:*` principals
+- document provider-specific setup in a local `README.md`
+
+Open-source providers with `mode: compose-ci` are intended for the shared auth
+matrix. Reference-only providers stay documented and manifest-driven but are
+excluded from the local Compose-backed matrix.

contrib/auth/authelia/README.md

@@ -0,0 +1,14 @@
+# Authelia Reference
+
+## Local reference
+
+1. Start the local stack with `docker compose up -d`.
+2. Wait for OIDC discovery to return healthy.
+3. Run the shared auth-idp matrix with `-k authelia`.
+
+## Production adaptation
+
+- configure NeMo `auth.oidc` with the Authelia issuer
+- enforce gateway-level stripping for trusted principal headers
+- map NeMo authorization to Authelia groups
+- keep machine callers on standard OIDC subject identifiers

contrib/auth/authelia/config/nemo-auth.yaml

@@ -0,0 +1,8 @@
+auth:
+  enabled: true
+  oidc:
+    enabled: true
+    issuer: http://127.0.0.1:48081
+    client_id: nemo-local
+    subject_claim: sub
+    groups_claim: groups

contrib/auth/authelia/docker-compose.yml

@@ -0,0 +1,14 @@
+services:
+  gateway:
+    image: envoyproxy/envoy:v1.33-latest
+    command: ["envoy", "-c", "/etc/envoy/envoy.yaml"]
+    volumes:
+      - ./gateway/envoy.yaml:/etc/envoy/envoy.yaml:ro
+    ports:
+      - "48080:8080"
+
+  authelia:
+    image: authelia/authelia:4.39
+    command: ["authelia", "serve", "--config", "/config/configuration.yml"]
+    ports:
+      - "48081:9091"

contrib/auth/authelia/gateway/envoy.yaml

@@ -0,0 +1,45 @@
+static_resources:
+  listeners:
+    - name: listener_0
+      address:
+        socket_address:
+          address: 0.0.0.0
+          port_value: 8080
+      filter_chains:
+        - filters:
+            - name: envoy.filters.network.http_connection_manager
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                stat_prefix: ingress_http
+                route_config:
+                  name: local_route
+                  virtual_hosts:
+                    - name: nemo
+                      domains: ["*"]
+                      request_headers_to_remove:
+                        - x-nmp-principal-id
+                        - x-nmp-principal-email
+                        - x-nmp-principal-groups
+                        - x-nmp-principal-on-behalf-of
+                        - x-nmp-principal-on-behalf-of-email
+                        - x-nmp-principal-on-behalf-of-groups
+                      routes:
+                        - match:
+                            prefix: "/"
+                          route:
+                            cluster: nemo
+                http_filters:
+                  - name: envoy.filters.http.router
+  clusters:
+    - name: nemo
+      connect_timeout: 5s
+      type: LOGICAL_DNS
+      load_assignment:
+        cluster_name: nemo
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: nemo
+                      port_value: 8080

contrib/auth/authelia/manifest.yaml

@@ -0,0 +1,26 @@
+provider: authelia
+mode: compose-ci
+compose_file: docker-compose.yml
+gateway_base_url: http://127.0.0.1:48080
+issuer_url: http://127.0.0.1:48081
+discovery_url: http://127.0.0.1:48081/.well-known/openid-configuration
+nemo_config: config/nemo-auth.yaml
+principal_contract:
+  subject_claim: sub
+  groups_claim: groups
+  external_machine_principals_use_service_prefix: false
+  internal_service_prefix_reserved: "service:"
+human_identity:
+  username: demo-user
+  expected_email: demo-user@example.com
+machine_identity:
+  principal_id: authelia-machine-subject
+  expected_groups:
+    - nemo-editors
+healthchecks:
+  - kind: http
+    url: http://127.0.0.1:48081/.well-known/openid-configuration
+startup_timeouts:
+  healthchecks_seconds: 120
+  gateway_seconds: 30
+  token_endpoint_seconds: 60