Feat/auth server integration by charming-wicket-5502 · Pull Request #1013 · Cosmian/kms

charming-wicket-5502 · 2026-06-16T12:56:56Z

Closes #879

Copilot

Pull request overview

This PR introduces a new “Cosmian authentication server” integration across the KMS server and ckms client by adding a dedicated server middleware (CosmianAuth) and a client-side ckms login cosmian flow.

Changes:

Add server-side CosmianAuth middleware that validates Bearer JWTs using JWKS (including a “no kid” verification strategy that tries all keys).
Extend configuration (CLI/TOML + wizard) to enable Cosmian auth and control JWKS fetching (including an “accept invalid certs” option).
Add client-side login helper (cosmian_login) and CLI subcommand (ckms login cosmian) to extract the _ea_ cookie value and store/forward it as an access token.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`crate/server/src/start_kms_server.rs`	Wires Cosmian auth into the authenticated scopes and builds a dedicated JWKS manager for it.
`crate/server/src/middlewares/mod.rs`	Exposes the new `CosmianAuth` middleware.
`crate/server/src/middlewares/jwt/jwks.rs`	Adds JWKS options (`accept_invalid_certs`) and a `find_any()` helper for key iteration.
`crate/server/src/middlewares/cosmian_auth/mod.rs`	Introduces the Cosmian auth middleware module.
`crate/server/src/middlewares/cosmian_auth/cosmian_auth_middleware.rs`	Actix middleware wrapper that injects `AuthenticatedUser` after token validation.
`crate/server/src/middlewares/cosmian_auth/cosmian_auth_token.rs`	Token parsing + validation logic (no-`kid` behavior, algorithm allowlist, claim mapping).
`crate/server/src/main.rs`	Updates test config construction to include `cosmian_auth`.
`crate/server/src/config/wizard/mod.rs`	Plumbs wizard output into server config for Cosmian auth.
`crate/server/src/config/wizard/auth_wizard.rs`	Adds interactive wizard support for Cosmian auth server + JWKS options.
`crate/server/src/config/params/server_params.rs`	Adds `cosmian_auth_config` to computed server params.
`crate/server/src/config/command_line/mod.rs`	Registers the new Cosmian auth config module.
`crate/server/src/config/command_line/cosmian_auth_config.rs`	Defines `CosmianAuthConfig` and its CLI/env/TOML mapping.
`crate/server/src/config/command_line/clap_config.rs`	Adds `cosmian_auth` to `ClapConfig` and debug output.
`crate/clients/client/src/http_client/mod.rs`	Re-exports Cosmian login helpers/config.
`crate/clients/client/src/http_client/login.rs`	Implements `CosmianLoginConfig` + `cosmian_login()` extracting `_ea_` cookie.
`crate/clients/client/src/http_client/client.rs`	Adds `cosmian_conf` to client config deserialization.
`crate/clients/clap/src/actions/login.rs`	Changes `ckms login` into subcommands (`oauth` / `cosmian`).
`crate/clients/ckms/src/tests/login_tests.rs`	Updates existing tests to call `ckms login oauth`.
`CHANGELOG/feat_auth-server-integration.md`	Adds branch changelog entry describing the feature.
`.gitignore`	Ignores `.github/agents/`.

 #[derive(Debug)]
 pub struct JwksManager {
    pub(crate) uris: Vec<String>,
    pub(crate) jwks: RwLock<HashMap<String, JwkSet>>,
    pub(crate) last_update: RwLock<Option<DateTime<Utc>>>,
    pub(crate) proxy_params: Option<ProxyParams>,
+    /// When `true`, the JWKS fetch client skips TLS certificate verification.
+    /// Only set this for development/test environments (e.g. self-signed certs).
+    pub(crate) accept_invalid_certs: bool,
 }


+        let jwks_uri = cosmian_cfg.jwks_uri().ok_or_else(|| {
+            KmsError::ServerError(
+                "Cosmian auth is enabled but no server URL is configured".to_owned(),
+            )
+        })?;
+        let proxy_params = kms_server.params.proxy_params.clone();


+    // Determine if Cosmian Auth Server should be used for authentication.
+    let (use_cosmian_auth, cosmian_auth_jwks_manager) = if let Some(ref cosmian_cfg) =
+        kms_server.params.cosmian_auth_config
+    {
+        let jwks_uri = cosmian_cfg.jwks_uri().ok_or_else(|| {
+            KmsError::ServerError(
+                "Cosmian auth is enabled but no server URL is configured".to_owned(),
+            )
+        })?;
+        let proxy_params = kms_server.params.proxy_params.clone();
+        let mgr = Arc::new(
+            JwksManager::new_with_options(
+                vec![jwks_uri],
+                proxy_params.as_ref(),
+                cosmian_cfg.cosmian_auth_accept_invalid_certs,
+            )
+            .await
+            .map_err(|e| {
+                KmsError::ServerError(format!(
+                    "Failed to initialise Cosmian auth JWKS manager: {e}"
+                ))
+            })?,
+        );
+        (true, Some(mgr))
+    } else {
+        (false, None)
+    };


+/// ```toml
+/// [cosmian_auth]
+/// server_url            = "https://localhost:8443"
+/// accept_invalid_certs  = false   # set true only for dev/test
+/// ```
+///
+/// The JWKS endpoint is derived automatically from `server_url` as
+/// `{server_url}/.well-known/jwks.json` unless overridden via `jwks_uri`.


+        let server_url: String = Input::with_theme(&theme)
+            .with_prompt("Cosmian auth server URL (e.g. https://auth.example.com)")
+            .interact_text()
+            .map_err(|e| KmsError::ServerError(format!("Prompt error: {e}")))?;
+        let jwks_uri: String = Input::with_theme(&theme)


+    let url = format!(
+        "{}/login?realm={}",
+        config.server_url.trim_end_matches('/'),
+        config.realm
+    );


+    cmd.env(CKMS_CONF_ENV, &conf_path).arg("login").arg("oauth");

    let output = recover_cmd_logs(&mut cmd);
    assert!(


+        // Fetch all public keys — Cosmian tokens have no `kid` so we try them all.
+        let jwks = jwks_manager.find_any()?;
+        if jwks.is_empty() {
+            // JWKS cache might be stale; attempt one refresh.
+            jwks_manager.refresh().await?;
+        }
+        let jwks = jwks_manager.find_any()?;


Manuthor

Just a few basic suggestions, not much

Great job!

Manuthor · 2026-06-24T13:58:53Z


-    #[command(flatten)]
+    #[clap(flatten)]
+    pub cosmian_auth: CosmianAuthConfig,


CosmianAuth being a little vague. Do you think we can find an alternative at least for this CosmianAuthConfig?
What about CosmianAuthServerConfig or CosmianSessionAuthConfig?

About auth server name, we definitely need to find a proper name for the auth server. Should we stick to Cosmian Authentication server or Cosmian IdP since it tends to be an IdP?

Manuthor · 2026-06-24T14:03:13Z

+/// realm      = "kms"
+/// ```
+#[derive(Serialize, Deserialize, Eq, PartialEq, Debug, Clone)]
+pub struct CosmianLoginConfig {


Suggested change

pub struct CosmianLoginConfig {

pub struct CosmianAuthServerLoginConfig {

?

Manuthor · 2026-06-24T14:06:26Z

We can rename the filename to be more accurate

Manuthor · 2026-06-24T14:10:45Z

Rename to .../cosmian_auth_server/middleware.rs please

Manuthor · 2026-06-24T14:11:56Z

Please rename it too

Manuthor · 2026-06-24T14:16:26Z

+    let auth_header = req
+        .headers()
+        .get(header::AUTHORIZATION)
+        .and_then(|h| h.to_str().ok())
+        .unwrap_or("");
+
+    // Parse "Bearer <token>".
+    let mut parts = auth_header.splitn(2, ' ');
+    let scheme = parts.next().unwrap_or("");
+    let token = parts.next().unwrap_or("").trim();
+
+    if !scheme.eq_ignore_ascii_case("Bearer") || token.is_empty() {
+        return Err(KmsError::Unauthorized(
+            "Cosmian auth: missing or malformed Authorization header (expected Bearer token)"
+                .to_owned(),
+        ));
+    }


We could mutualize this code with similar token-extraction code from api_token_auth.rs (probably create a shared function)

charming-wicket-5502 added 2 commits June 10, 2026 10:50

Auth server integration first draft

6bd4fac

Working version

fbafaf2

charming-wicket-5502 requested a review from Manuthor June 16, 2026 12:56

charming-wicket-5502 self-assigned this Jun 16, 2026

Manuthor requested a review from Copilot June 17, 2026 08:27

Copilot started reviewing on behalf of Manuthor June 17, 2026 08:28 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

charming-wicket-5502 added 3 commits June 19, 2026 10:19

totp working version

f21ac1f

typo fix

77aefc3

IdToken to session rework first draft

8ef543a

Manuthor reviewed Jun 25, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Feat/auth server integration#1013

Feat/auth server integration#1013
charming-wicket-5502 wants to merge 5 commits into
developfrom
feat/auth-server-integration

charming-wicket-5502 commented Jun 16, 2026 •

edited by Manuthor

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Manuthor left a comment

Uh oh!

Manuthor Jun 24, 2026

Uh oh!

Manuthor Jun 24, 2026

Uh oh!

Manuthor Jun 24, 2026

Uh oh!

Manuthor Jun 24, 2026

Uh oh!

Manuthor Jun 24, 2026

Uh oh!

Manuthor Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	pub struct CosmianLoginConfig {
	pub struct CosmianAuthServerLoginConfig {

Uh oh!

Conversation

charming-wicket-5502 commented Jun 16, 2026 • edited by Manuthor Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Manuthor left a comment

Choose a reason for hiding this comment

Uh oh!

Manuthor Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Manuthor Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Manuthor Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Manuthor Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Manuthor Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Manuthor Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

charming-wicket-5502 commented Jun 16, 2026 •

edited by Manuthor

Loading