update

Signed-off-by: Ryan S <267728323+ironcommit@users.noreply.github.com>

Author: ironcommit

docs/set-up/config-reference.mdx

@@ -315,6 +315,8 @@ jobs:
         password_env_var: AUTHENTIK_WORKLOAD_IDENTITY_PASSWORD
         # OAuth scope for the Docker demo issuer.
         scope:
+        # Docker workload proof-token provider. 'auto' uses an in-process auth-owned JWT issuer when available and otherwise uses an opaque proof token stored by hash in the workload delegation record. | default: 'auto' | values: 'auto' | 'jwt' | 'opaque'
+        proof_token_provider: auto
         # Fallback subject-token lifetime when the Docker demo issuer response omits expires_in.
         subject_token_ttl_seconds: 600
         # Seconds before subject-token expiry when the Docker refresher issues a replacement token. | default: 60

openapi/ga/individual/platform.openapi.yaml

@@ -26,6 +26,8 @@
 TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange"
 JWT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:jwt"
 ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token"
+DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE = "urn:nvidia:nemo:params:oauth:token-type:docker-opaque-workload-proof"
+DOCKER_OPAQUE_WORKLOAD_PROOF_PREFIX = "nmp_obo_v1."
 
 
 class WorkloadTokenExchangeError(RuntimeError):
@@ -72,6 +74,12 @@ def _validate_token_endpoint(token_endpoint: str) -> None:
     )
 
 
+def subject_token_type_for_exchange(subject_token: str) -> str:
+    if subject_token.startswith(DOCKER_OPAQUE_WORKLOAD_PROOF_PREFIX):
+        return DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE
+    return JWT_TOKEN_TYPE
+
+
 def token_exchange_grant(
     *,
     token_endpoint: str,
@@ -87,7 +95,7 @@ def token_exchange_grant(
         "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
         "client_id": client_id,
         "subject_token": subject_token,
-        "subject_token_type": JWT_TOKEN_TYPE,
+        "subject_token_type": subject_token_type_for_exchange(subject_token),
         "requested_token_type": ACCESS_TOKEN_TYPE,
     }
     if audience:

openapi/ga/openapi.yaml

@@ -8,9 +8,11 @@
 from base64 import urlsafe_b64encode
 from unittest.mock import MagicMock, patch
 
+import httpx
 import pytest
 from nemo_platform_ext.auth.workload_exchange import (
     ACCESS_TOKEN_TYPE,
+    DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE,
     JWT_TOKEN_TYPE,
     TOKEN_EXCHANGE_GRANT_TYPE,
     WorkloadTokenExchangeError,
@@ -74,6 +76,19 @@ def test_token_exchange_grant_sends_rfc8693_request(mock_post):
     }
 
 
+@patch("nemo_platform_ext.auth.workload_exchange.httpx.post")
+def test_token_exchange_grant_uses_docker_opaque_subject_token_type(mock_post):
+    mock_post.return_value = httpx.Response(200, json={"access_token": "exchanged-token", "expires_in": 300})
+
+    token_exchange_grant(
+        token_endpoint="https://idp.example.com/token",
+        client_id="nemo-platform-workload",
+        subject_token="nmp_obo_v1.delegation.secret",
+    )
+
+    assert mock_post.call_args.kwargs["data"]["subject_token_type"] == DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE
+
+
 @patch("nemo_platform_ext.auth.workload_exchange.httpx.post")
 def test_token_exchange_grant_rejects_http_non_loopback_endpoint_before_sending_subject_token(mock_post):
     with pytest.raises(ValueError, match="must use HTTPS"):

openapi/openapi.yaml

@@ -126,6 +126,8 @@ def generate_unsigned_jwt(
 TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange"
 JWT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:jwt"
 ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token"
+DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE = "urn:nvidia:nemo:params:oauth:token-type:docker-opaque-workload-proof"
+DOCKER_OPAQUE_WORKLOAD_PROOF_PREFIX = "nmp_obo_v1."
 
 
 @dataclass(frozen=True)
@@ -292,6 +294,12 @@ def read_subject_token_file(path: Path) -> str:
     return token
 
 
+def subject_token_type_for_exchange(subject_token: str) -> str:
+    if subject_token.startswith(DOCKER_OPAQUE_WORKLOAD_PROOF_PREFIX):
+        return DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE
+    return JWT_TOKEN_TYPE
+
+
 def token_exchange_grant(
     *,
     token_endpoint: str,
@@ -309,7 +317,7 @@ def token_exchange_grant(
         "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
         "client_id": client_id,
         "subject_token": subject_token,
-        "subject_token_type": JWT_TOKEN_TYPE,
+        "subject_token_type": subject_token_type_for_exchange(subject_token),
         "requested_token_type": ACCESS_TOKEN_TYPE,
     }
     if audience:

packages/nemo_platform_ext/src/nemo_platform_ext/auth/workload_exchange.py

@@ -26,6 +26,7 @@
 from nemo_platform_plugin.client.constants import WORKLOAD_IDENTITY_TOKEN_FILE_ENVVAR
 from nemo_platform_plugin.client.oidc import (
     ACCESS_TOKEN_TYPE,
+    DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE,
     JWT_TOKEN_TYPE,
     TOKEN_EXCHANGE_GRANT_TYPE,
     NMPOIDCConfig,
@@ -335,6 +336,20 @@ def test_token_exchange_grant_sends_rfc8693_request(self, monkeypatch):
             verify=True,
         )
 
+    def test_token_exchange_grant_uses_docker_opaque_subject_token_type(self, monkeypatch):
+        monkeypatch.delenv(NMP_CLIENT_SSL_CERT_FILE_ENVVAR, raising=False)
+
+        with patch("nemo_platform_plugin.client.oidc.httpx.post") as mock_post:
+            mock_post.return_value = httpx.Response(200, json={"access_token": "exchanged-token", "expires_in": 300})
+
+            token_exchange_grant(
+                token_endpoint="https://idp.example.com/token",
+                client_id="nemo-platform-workload",
+                subject_token="nmp_obo_v1.delegation.secret",
+            )
+
+        assert mock_post.call_args.kwargs["data"]["subject_token_type"] == DOCKER_OPAQUE_WORKLOAD_PROOF_TOKEN_TYPE
+
     def test_token_exchange_grant_uses_nemo_scoped_ca_bundle(self, monkeypatch):
         monkeypatch.setenv(NMP_CLIENT_SSL_CERT_FILE_ENVVAR, "/tmp/nemo-ca.pem")