Skip to content

feat(auth): add Microsoft Entra ID support with On-Behalf-Of token exchange#953

Open
nader-ziada wants to merge 1 commit intocontainers:mainfrom
nader-ziada:entraid
Open

feat(auth): add Microsoft Entra ID support with On-Behalf-Of token exchange#953
nader-ziada wants to merge 1 commit intocontainers:mainfrom
nader-ziada:entraid

Conversation

@nader-ziada
Copy link
Copy Markdown
Collaborator

Add support for Microsoft Entra ID (Azure AD) as an OIDC provider

Changes:

  • Add entra-obo token exchange strategy for On-Behalf-Of flow
  • Implement well-known endpoint fallback for providers without oauth-authorization-server (falls back to openid-configuration)
  • Add a new config option cluster_auth_mode that has two values: passthrough and kubeconfig
    • Add auto-detection: passthrough when require_oauth=true, else kubeconfig
    • Passthrough mode now automatically exchanges tokens if configured

@Cali0707 Cali0707 requested review from Cali0707, manusa and matzew and removed request for matzew March 23, 2026 18:00
@nader-ziada nader-ziada force-pushed the entraid branch 4 times, most recently from f64b10d to 5f76f86 Compare April 8, 2026 17:49
…change

Add support for Microsoft Entra ID (Azure AD) as an OIDC provider

add JWT client assertion support for Entra ID OBO flow

Implement RFC 7523 JWT Client Assertion for Microsoft Entra ID
On-Behalf-Of token exchange, enabling certificate-based authentication
as an alternative to client secrets.

Signed-off-by: Nader Ziada <nziada@redhat.com>
@nader-ziada nader-ziada marked this pull request as ready for review April 9, 2026 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant