Overview

This PR adds comprehensive OAuth2/OIDC Single Sign-On (SSO) support for VeADK Web and implements Access Token validation based on JWKS with optional Introspection.

Key Changes

1. OAuth2 Middleware Enhancements

• OIDC JWKS Validation: Support JWT Access Token validation via JWKS (JSON Web Key Set)
• Optional Introspection: Support OAuth2 Token Introspection endpoint for opaque token validation
• Dual Authentication Sources: Validates both Authorization Header and Session Cookie tokens
• No Authorization Passthrough: Middleware no longer passes through the original client Authorization header; instead uses the validated Session Token

2. /oauth2/userinfo Endpoint Token Validation

• The /oauth2/userinfo endpoint now validates the Access Token in the Session before returning user info
• Ensures returned user information corresponds to a valid authentication state

3. VeADK Web CLI Integration

• veadk web command supports --oauth2-user-pool and --oauth2-user-pool-client parameters
• Automatic OAuth2 middleware configuration with VeIdentity User Pool integration

Technical Implementation

Access Token Validation Flow

┌─────────────────┐
│ Request Arrives │
└────────┬────────┘
         │
         ▼
┌─────────────────┐     Has Authorization Header?
│  Check Auth     │────────────────────────────┐
│  Header         │                            │
└────────┬────────┘                            │
         │ No                                  │ Yes
         ▼                                     ▼
┌─────────────────┐                   ┌─────────────────┐
│  Check Session  │                   │  Extract Bearer │
│  Cookie         │                   │  Token          │
└────────┬────────┘                   └────────┬────────┘
         │                                     │
         ▼                                     ▼
┌─────────────────┐                   ┌─────────────────┐
│  Validate       │                   │  JWKS/Intro-    │
│  Session Token  │                   │  spection       │
└────────┬────────┘                   └────────┬────────┘
         │                                     │
         ▼                                     ▼
┌─────────────────┐                   ┌─────────────────┐
│  Inject Auth    │                   │  Set User       │
│  Header         │                   │  Scope          │
└────────┬────────┘                   └────────┬────────┘
         │                                     │
         └──────────────┬──────────────────────┘
                        ▼
               ┌─────────────────┐
               │ Continue Request│
               └─────────────────┘

New Configuration Parameters

Security Features

• ✅ Algorithm Whitelist: Prevents alg=none attacks
• ✅ Issuer Validation: Ensures token is from expected IdP
• ✅ Audience Validation: Ensures token is issued for this application
• ✅ Expiration Validation: Automatically rejects expired tokens
• ✅ JWKS Caching: Reduces requests to IdP, supports auto-refresh on KID miss
• ✅ Cookie Signing: Session cookies are signed with HMAC-SHA256