identity: add OAuth2 mTLS authentication - #3940
Open
rm-you wants to merge 3 commits into
Open
Conversation
github-actions
Bot
added
edit:openstack
rm-you
marked this pull request as ready for review
August 12, 2026 08:14
rm-you
changed the title
rm-you
force-pushed
the
feat/oauth2-mtls
branch
from
August 18, 2026 04:04
bed0650 to
fec11ed
Compare
github-actions
Bot
added
semver:minor
|
coverage: 63.738% (+0.2%) from 63.588% — rm-you:feat/oauth2-mtls into gophercloud:main |
Contributor
Author
|
@stephenfin I think the Zun failure on both this and #3941 are spurious? Is there a way we can recheck (or is something maybe broken there)? |
Sharpz7
self-requested a review
September 2, 2026 05:42
Sharpz7
previously approved these changes
Sep 2, 2026
rm-you
force-pushed
the
feat/oauth2-mtls
branch
from
September 6, 2026 07:51
fec11ed to
48a4b8b
Compare
rm-you
added a commit
to rm-you/gophercloud
that referenced
this pull request
Sep 8, 2026
Contributor
Author
|
I don't have permissions to re-run the failed nova CI, but I'm pretty confident it is unrelated, can someone re-trigger that? |
Refs gophercloud#3915 Co-authored-by: Taiwo Oyewole <taiwooyewole@geico.com>
rm-you
added a commit
to rm-you/gophercloud
that referenced
this pull request
Sep 9, 2026
rm-you
force-pushed
the
feat/oauth2-mtls
branch
from
September 9, 2026 23:24
48a4b8b to
1e2c224
Compare
Contributor
Author
|
Rebased onto current main and fixed auth-header precedence: generated headers now precede MoreHeaders/OmitHeaders, so caller overrides and omissions work for both bearer and X-Auth-Token authentication, including retries. The token snapshot used for concurrent reauthentication is preserved. Added regression coverage; the full race suite and lint pass. |
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3915
Adds Identity v3 authentication using OAuth 2.0 mutual TLS client credentials. It obtains an access token from
OS-OAUTH2/token, validates it with Keystone to populate the service catalog, and sends it asAuthorization: Beareron service requests. The same flow is used for reauthentication.ProviderClientnow supports authentication headers other thanX-Auth-Token; existing authentication methods are unchanged.Includes unit and acceptance tests.
Links to the line numbers/files in the OpenStack source code that support the code in this PR: