update

Signed-off-by: Ryan S <267728323+ironcommit@users.noreply.github.com>

Author: ironcommit

contrib/auth/authentik/README.md

@@ -90,10 +90,9 @@ refresh is easy to observe. Do not use it as a production default; use a longer
 value such as `hours=1` outside the refresh demonstration.
 
 In the Docker Compose runtime, Authentik authenticates users and controller
-service principals, but managed Docker job OBO does not depend on Authentik
-password-grant workload tokens or an IdP `jti` claim. The Docker backend writes
-a NeMo Platform-owned workload proof token into the job token file, the SDK
-posts that token to the NeMo Platform auth service, and the gateway trusts the
-NeMo Platform auth service JWKS for exchanged workload access tokens. The
-Authentik workload-provider password grant remains in the example manifest for
-direct provider-token contract tests.
+service principals, but managed Docker job OBO uses a NeMo Platform-owned
+opaque workload proof token. The Docker backend writes that proof token into the
+job token file, the SDK posts it to the NeMo Platform auth service, and the
+gateway trusts the NeMo Platform auth service JWKS for exchanged workload access
+tokens. Docker OBO does not depend on IdP `jti` claims or IdP-issued workload
+subject tokens.

contrib/auth/authentik/compose/implementation-details.md

@@ -20,7 +20,7 @@ the parent directory:
 
 - `../config/platform-compose-authentik.yaml` as the NeMo Platform config.
 - `../gateway/envoy.yaml` as the local gateway config.
-- `../helm/files/blueprints` as the |product-name| blueprint source.
+- `../helm/files/blueprints` as the NeMo Platform blueprint source.
 - `../.generated` for local generated keys and certificates.
 
 The shared tutorial does not build NeMo Platform images for Compose. It runs
@@ -37,7 +37,7 @@ The stack contains:
 - `gateway-tls-init`: a small init container that copies local TLS material into
   the named `gateway-tls` volume with permissions suitable for Envoy.
 - `authentik-blueprint-init`: a one-shot init container that applies the shared
-  |product-name| blueprint before the gateway starts.
+  NeMo Platform blueprint before the gateway starts.
 - `authentik-postgres`: PostgreSQL for Authentik.
 - `authentik-redis`: Redis for Authentik.
 - `authentik-server` and `authentik-worker`: Authentik itself.
@@ -168,21 +168,14 @@ mints a NeMo Platform-signed delegated access token, and returns it to the
 workload. The access token uses the captured job submitter as the top-level
 subject and the Docker workload as the RFC 8693 `act.sub` actor.
 
-Docker supports two proof-provider modes:
-
-- `jwt`: for embedded standalone deployments where the Docker jobs controller
-  has an in-process auth-owned JWT issuer. The proof JWT uses
-  `token_use="nemo_docker_workload_subject"` and `sub=<delegation-row-name>`.
-- `opaque`: for split deployments where the jobs controller calls remote auth
-  state instead of owning signing keys. The file contains a private opaque proof
-  token type whose secret is stored only as a hash in the delegation row.
-
-The checked-in Compose example uses the default `auto` mode, which selects the
-opaque provider unless an embedded auth-owned JWT issuer is available. Docker
-job OBO therefore does not require Authentik to issue a workload token and does
-not depend on an IdP `jti` claim. The Authentik workload-provider password
-grant in the manifest is retained for direct provider-token contract tests, not
-for the managed Docker job exchange loop.
+Docker supports one proof-token mechanism in this flow. The file contains a
+private opaque proof token whose secret is stored only as a hash in the
+delegation row.
+
+Docker job OBO therefore does not require Authentik to issue a workload token
+and does not depend on an IdP `jti` claim. The Authentik workload-provider
+configuration in the manifest is retained for direct provider-token contract
+tests, not for the managed Docker job exchange loop.
 
 The useful end-to-end validation is the workload job in the shared tutorial:
 the job uses the exchanged token to call the NeMo Platform API and read the

contrib/auth/authentik/config/platform-compose-authentik.yaml

@@ -64,10 +64,6 @@ jobs:
           additional_volume_mounts:
             - volume_name: "authentik_gateway_tls"
               mount_path: "/etc/nmp/gateway-tls"
-        workload_identity:
-          token_endpoint: "https://nemo-gateway:8080/application/o/token/"
-          username: "svc-nemo"
-          password_env_var: "AUTHENTIK_WORKLOAD_IDENTITY_PASSWORD"
   executor_defaults:
     docker:
       cleanup_completed_jobs_immediately: false

contrib/auth/authentik/manifest.yaml

@@ -73,7 +73,6 @@ test_runtimes:
       - workload_job
       - managed_workload_job_obo
       - device_flow
-      - docker_subject_token_refresh
   - id: authentik-kubernetes
     backend: kubernetes
     command: k8s

docs/auth/deployment/configuration.mdx

@@ -201,27 +201,10 @@ and optional `scope`. `workload_token_endpoint` is optional; when it is unset,
 the SDK uses `token_endpoint`. This is useful when host CLI login and workload
 containers need different network-reachable IdP URLs.
 
-For Docker-backed job runtimes, the executor may also need a controller-side
-subject-token issuer. Configure only Docker-specific fields under the Docker
-executor profile:
-
-```yaml
-jobs:
-  executors:
-    - provider: cpu
-      profile: workload
-      backend: docker
-      config:
-        workload_identity:
-          token_endpoint: "https://idp.example.com/oauth/token"
-          client_id: "nemo-platform-workload"
-          username: "svc-nemo"
-          password_env_var: "WORKLOAD_IDENTITY_PASSWORD"
-          scope: "openid email groups"
-```
-
-The password value is read from the controller process environment using
-`password_env_var`. The config does not support an inline `password` field.
+For Docker-backed job runtimes, `auth.oidc.workload_token_exchange_enabled`
+controls workload identity. When enabled, job steps with a delegation auth
+context receive a NeMo Platform opaque workload proof token at
+`NMP_WORKLOAD_IDENTITY_TOKEN_FILE`.
 
 For Kubernetes-backed job runtimes, the jobs backend can project a Kubernetes
 service account token into each workload pod for token exchange. The projected

docs/auth/deployment/credential-propagation.mdx

@@ -63,10 +63,10 @@ Backend ownership:
   `authentication.kubernetes.io/pod-uid` reference from TokenReview metadata to
   look up the internal delegation row.
 - Docker uses a dedicated controller-managed workload identity volume. The
-  Docker backend writes a proof token bound to an internal delegation row. JWT
-  proof tokens carry `token_use="nemo_docker_workload_subject"`. Opaque proof
-  tokens use the private Docker subject-token type and are checked against the
-  hash stored in the delegation row.
+  Docker backend writes a NeMo opaque proof token bound to an internal
+  delegation row. The token uses the private Docker subject-token type and is
+  checked against the hash stored in the delegation row. Docker does not use
+  TokenReview or external IdP-issued workload proof tokens.
 
 Users must not provide `NMP_PRINCIPAL`, `NEMO_WORKLOAD_TOKEN`,
 `NEMO_WORKLOAD_TOKEN_FILE`, or `NMP_WORKLOAD_IDENTITY_TOKEN_FILE` in managed job

docs/set-up/config-reference.mdx

@@ -301,28 +301,8 @@ jobs:
       networking:
         # Docker network for the job container | default: 'host'
         job_container_network: host
-      # Docker workload identity subject-token issuer configuration.
-      workload_identity:
-        # Enable Docker workload identity token-file injection. Defaults to auth.oidc.workload_token_exchange_enabled.
-        enabled:
-        # OAuth token endpoint used by the Docker demo issuer. Defaults to auth.oidc.token_endpoint.
-        token_endpoint:
-        # OAuth client ID used by the Docker demo issuer. Defaults to auth.oidc.workload_client_id or auth.oidc.client_id.
-        client_id:
-        # OAuth client secret for the Docker demo issuer.
-        client_secret:
-        # Username for the Docker demo issuer password grant.
-        username:
-        # Controller environment variable that contains the Docker demo issuer password grant shared secret. | default: 'AUTHENTIK_WORKLOAD_IDENTITY_PASSWORD'
-        password_env_var: AUTHENTIK_WORKLOAD_IDENTITY_PASSWORD
-        # OAuth scope for the Docker demo issuer.
-        scope:
-        # Docker workload proof-token provider. 'auto' uses an in-process auth-owned JWT issuer when available and otherwise uses an opaque proof token stored by hash in the workload delegation record. | default: 'auto' | values: 'auto' | 'jwt' | 'opaque'
-        proof_token_provider: auto
-        # Fallback subject-token lifetime when the Docker demo issuer response omits expires_in.
-        subject_token_ttl_seconds: 600
-        # Seconds before subject-token expiry when the Docker refresher issues a replacement token. | default: 60
-        refresh_margin_seconds: 60
+      # Docker workload identity configuration.
+      workload_identity: {}
     # Default Kubernetes execution profile configuration
     kubernetes_job:
       # default: 1800