feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods by aniketpalu · Pull Request #6089 · feast-dev/feast

aniketpalu · 2026-03-10T12:50:04Z

What this PR does / why we need it:

Extracts groups and namespaces claims from the decoded JWT in OidcTokenParser.user_details_from_access_token() and passes them to the User object.

Previously, the OIDC token parser only read preferred_username and resource_access roles from the JWT, always returning User(username, roles) with empty groups and namespaces. This meant that GroupBasedPolicy, NamespaceBasedPolicy, and CombinedGroupNamespacePolicy could never grant access for OIDC-authenticated users — even when the JWT contained valid claims.

Server-Side Changes

Files: oidc_token_parser.py, utils.py
When auth.type: oidc, the Feast server now handles two types of incoming tokens:

Keycloak JWTs (from human users via UI/Swagger) — validated against Keycloak JWKS, extracts preferred_username, groups, and roles. Used by GroupBasedPolicy.
Kubernetes SA tokens (from workbench pods) — detected via kubernetes.io claim, delegated to existing KubernetesTokenParser which validates via TokenAccessReview and extracts namespace. Used by NamespaceBasedPolicy.
Token type detection happens before any cryptographic validation — a lightweight unverified decode checks for the kubernetes.io claim. If the K8s API is unavailable (non-K8s deployment), the server falls back to Keycloak-only mode.

Client-Side Changes

Files: oidc_authentication_client_manager.py, auth_model.py, repo_config.py
OidcAuthClientManager.get_token() now supports multiple token sources with clear priority:

Explicit config (exclusive — only one is used): token, token_env_var, or client_secret + IDP network call
Bare config fallbacks (when nothing explicit is set): FEAST_OIDC_TOKEN env var, then mounted SA token file
This means a workbench pod with just auth: {type: oidc} automatically picks up its SA token. Human users can set FEAST_OIDC_TOKEN. Existing client_credentials/ROPG flows are unchanged.

Which issue(s) this PR fixes:

#6088

Misc

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…tacting the identity provider Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…t, reject stray auth_discovery_url/client_id without client_secret Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

… _is_oidc_client_config helper Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…one == None Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…ed KeyError Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…y, no RBAC queries Replace KubernetesTokenParser delegation with a lightweight _validate_k8s_sa_token_and_extract_namespace() method in OidcTokenParser. Validates SA tokens via TokenReview API and extracts namespace from the authenticated identity. No RoleBinding/ClusterRoleBinding queries needed, so the server SA only requires tokenreviews/create permission. Also updates OIDC auth documentation with token priority, verify_ssl, groups claim, and multi-token support sections. Made-with: Cursor Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com> Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…g for K8s token validation Signed-off-by: Aniket Paluskar <apaluska@redhat.com> Made-with: Cursor

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

…o upn (Azure AD / Entra ID) Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

ntkathole · 2026-03-24T05:54:02Z

sdk/python/feast/permissions/client/oidc_authentication_client_manager.py

+
+    def _fetch_token_from_idp(self) -> str:
+        """Obtain an access token via client_credentials or ROPG flow."""
+        assert self.auth_config.auth_discovery_url is not None


raise ValueError instead of assert

ntkathole · 2026-03-24T06:01:02Z

sdk/python/feast/permissions/auth/oidc_token_parser.py

+        """
+        from kubernetes import client, config
+
+        config.load_incluster_config()


re-creates the API client on every SA token validation, may be initialized once and reused ?

ntkathole · 2026-03-24T06:01:59Z

sdk/python/feast/permissions/client/oidc_authentication_client_manager.py

+            )
+
+    @staticmethod
+    def _read_sa_token() -> str | None:


Suggested change

def _read_sa_token() -> str | None:

def _read_sa_token() -> Optional[str]:

ntkathole · 2026-03-24T06:03:53Z

sdk/python/feast/permissions/auth/oidc_token_parser.py

+        """
+        if "preferred_username" in data:
+            return data["preferred_username"]
+        if "upn" in data:


_get_intra_comm_user also need to read upn ?

…, tokenEnvVar, verifySSL CRD fields Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

infra/feast-operator/config/manager/kustomization.yaml

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Remove 5 permissions test files (38 tests) that would conflict with feast-dev#6089 which restructures auth_model.py validation logic and OIDCDiscoveryService constructor. Removed files: - test_auth_model.py (14 tests) - test_enforcer.py (7 tests) - test_oidc_service.py (7 tests) - test_token_extractor.py (7 tests) - test_token_parser.py (3 tests) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jyejare · 2026-03-24T10:06:42Z

docs/getting-started/components/authz_manager.md

+
+#### Multi-Token Support (OIDC + Kubernetes Service Account)
+
+When the Feast server is configured with OIDC auth and deployed on Kubernetes, the `OidcTokenParser` can handle both Keycloak JWT tokens and Kubernetes service account tokens. Incoming tokens that contain a `kubernetes.io` claim are validated via the Kubernetes Token Access Review API and the namespace is extracted from the authenticated identity — no RBAC queries are performed, so the server service account only needs `tokenreviews/create` permission. All other tokens follow the standard OIDC/Keycloak JWKS validation path. This enables `NamespaceBasedPolicy` enforcement for service account tokens while using `GroupBasedPolicy` and `RoleBasedPolicy` for OIDC user tokens.


Do we support OIDC token passing from ODH Notebook instead of service account token ? This we alreayd support for kubernetes token.

Not a blocker though, just for consistency.

jyejare · 2026-03-24T10:10:56Z

infra/feast-operator/bundle/manifests/feast.dev_featurestores.yaml

+                        description: The name of the environment variable that client
+                          pods will use to read a pre-existing OIDC token.


Could you clarify which client pods we are talking about here ?

jyejare · 2026-03-24T10:15:24Z

infra/feast-operator/bundle/manifests/feast.dev_featurestores.yaml

                type: object
            required:
            - feastProject
-            - replicas


Is this change from auto-scaling commit. Does this PR need rebase ?

jyejare · 2026-03-26T11:27:57Z

sdk/python/feast/permissions/auth/oidc_token_parser.py

            raise AuthenticationError("Invalid token.")

+    @staticmethod
+    async def _validate_k8s_sa_token_and_extract_namespace(access_token: str) -> User:


I think we should create a common function for k8s sa token extraction to be used between both kubeterntes auth and OIDC auth.

jyejare · 2026-03-26T12:08:05Z

sdk/python/feast/permissions/auth_model.py

+    """
+    partial = [name for name, vals in groups.items() if any(vals) and not all(vals)]
+    if partial:
+        raise ValueError(


The current message is generic and doesn't specify which fields are actually required. A more helpful error would list the incomplete group's field names. For example:

raise ValueError( f"Incomplete configuration for '{partial[0]}': " f"all required fields for this group must be set together. " f"Check the documentation for valid credential combinations." )

Or even better, you could inspect the groups parameter to show exactly what's missing:

raise ValueError( f"Incomplete configuration for '{partial[0]}': " f"configure all of these fields together, or none at all." )

This would give users clearer guidance on what went wrong and how to fix it.

jyejare · 2026-03-26T12:25:30Z

sdk/python/feast/permissions/auth/oidc_token_parser.py

+            unverified = jwt.decode(access_token, options={"verify_signature": False})
+        except jwt.exceptions.DecodeError as e:
+            raise AuthenticationError(f"Failed to decode token: {e}")
+        return isinstance(unverified.get("kubernetes.io"), dict)


This runs on every non-intra-comm request before the normal OIDC path. The decoded payload is then discarded and the token is decoded again via _decode_token() for standard OIDC tokens. Consider caching the unverified decode result or restructuring to decode once.

feat: Extract groups and namespaces claims from JWT in OidcTokenParser

5514919

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

aniketpalu requested a review from a team as a code owner March 10, 2026 12:50

Merge branch 'master' into oidc-support

253eb34

This comment was marked as resolved.

Sign in to view

aniketpalu and others added 5 commits March 10, 2026 19:17

Minor formatting

9495db0

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Merge branch 'master' into oidc-support

57deeeb

feat: Allow Feast SDK to accept a pre-existing OIDC token without con…

41522ba

…tacting the identity provider Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Merge branch 'master' into oidc-support

1f4d2d2

Merge branch 'master' into oidc-support

8c8e805

This comment was marked as resolved.

Sign in to view

aniketpalu added 2 commits March 10, 2026 23:45

fix: Raise error when configured token_env_var is empty

dca71da

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Minor formatting changes

44a2727

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

This comment was marked as resolved.

Sign in to view

Activate _check_mutually_exclusive groups only when all fields are se…

62947e7

…t, reject stray auth_discovery_url/client_id without client_secret Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

This comment was marked as resolved.

Sign in to view

Merge branch 'master' into oidc-support

19ea1e3

This comment was marked as resolved.

Sign in to view

Merge branch 'master' into oidc-support

b1bc8df

This comment was marked as resolved.

Sign in to view

aniketpalu added 5 commits March 11, 2026 15:15

Narrow OIDC client routing to use set-based key detection and extract…

0bb5c57

… _is_oidc_client_config helper Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Fix .sort() assertions in test_token_parser.py that always compared N…

c1e5ecf

…one == None Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Guard against missing roles key in resource_access to prevent unhandl…

3320cea

…ed KeyError Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Fixed lint errors

4904257

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Fixed lint error

8be0d21

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

This comment was marked as resolved.

Sign in to view

Fixed lint errors

e32c486

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

aniketpalu marked this pull request as draft March 11, 2026 10:54

This comment was marked as resolved.

Sign in to view

aniketpalu added 2 commits March 11, 2026 21:40

Added support to read ServiceAccount token and Minor improvements

5892ff5

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Improved code readibility

f55fc52

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

aniketpalu requested review from lokeshrangineni, robhowley and tokoko March 23, 2026 15:33

aniketpalu force-pushed the oidc-support branch from bcd3bd3 to b15294d Compare March 23, 2026 15:39

This comment was marked as resolved.

Sign in to view

aniketpalu force-pushed the oidc-support branch from b15294d to 712a2b9 Compare March 23, 2026 15:41

This comment was marked as resolved.

Sign in to view

aniketpalu and others added 3 commits March 23, 2026 21:20

Minor reformatting & lint related changes

b9726d5

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Update sdk/python/feast/permissions/auth/oidc_token_parser.py

d141df3

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com> Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

Merge branch 'master' into oidc-support

7dfe9fd

aniketpalu force-pushed the oidc-support branch 2 times, most recently from bd69747 to 2ff5568 Compare March 23, 2026 16:00

This comment was marked as resolved.

Sign in to view

aniketpalu added 2 commits March 23, 2026 21:36

fix: Restore missing return in intra-comm check and add error handlin…

1bfe74b

…g for K8s token validation Signed-off-by: Aniket Paluskar <apaluska@redhat.com> Made-with: Cursor

Minor reformatting

9c26b7b

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

aniketpalu force-pushed the oidc-support branch 2 times, most recently from 09858f9 to 9c26b7b Compare March 23, 2026 16:21

Checks preferred_username first (Keycloak default), then falls back t…

ca1118c

…o upn (Azure AD / Entra ID) Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

ntkathole reviewed Mar 24, 2026

View reviewed changes

feat(operator): Split server/client OIDC config and add secretKeyName…

b51a33f

…, tokenEnvVar, verifySSL CRD fields Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

ntkathole reviewed Mar 24, 2026

View reviewed changes

infra/feast-operator/config/manager/kustomization.yaml Outdated Show resolved Hide resolved

Reverted kustomization.yaml

98a0209

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>

This comment was marked as resolved.

Sign in to view

Merge branch 'master' into oidc-support

8385a74

jyejare reviewed Mar 26, 2026

View reviewed changes

	def _read_sa_token() -> str \| None:
	def _read_sa_token() -> Optional[str]:


		#### Multi-Token Support (OIDC + Kubernetes Service Account)

		When the Feast server is configured with OIDC auth and deployed on Kubernetes, the `OidcTokenParser` can handle both Keycloak JWT tokens and Kubernetes service account tokens. Incoming tokens that contain a `kubernetes.io` claim are validated via the Kubernetes Token Access Review API and the namespace is extracted from the authenticated identity — no RBAC queries are performed, so the server service account only needs `tokenreviews/create` permission. All other tokens follow the standard OIDC/Keycloak JWKS validation path. This enables `NamespaceBasedPolicy` enforcement for service account tokens while using `GroupBasedPolicy` and `RoleBasedPolicy` for OIDC user tokens.

		description: The name of the environment variable that client
		pods will use to read a pre-existing OIDC token.

Conversation

aniketpalu commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Server-Side Changes

Client-Side Changes

Which issue(s) this PR fixes:

Misc

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

aniketpalu commented Mar 10, 2026 •

edited

Loading