feat: Disable use of private / public keys when IBM_AUTH_ENABLED is true#1409
Open
mpawlow wants to merge 1 commit intorelease-saas-0.1from
Open
feat: Disable use of private / public keys when IBM_AUTH_ENABLED is true#1409mpawlow wants to merge 1 commit intorelease-saas-0.1from
mpawlow wants to merge 1 commit intorelease-saas-0.1from
Conversation
github-actions
Bot
added
backend
mpawlow
force-pushed
the
mp/feat/saas/GH-1393-disable-private-keys-ibm-auth-enabled
branch
from
7137d56 to
5faf2a9
Compare
github-actions
Bot
added
enhancement
github-actions
Bot
added
enhancement
Collaborator
Author
Test Cloud / SaaS Build |
Collaborator
Author
Status Update
|
mpawlow
force-pushed
the
mp/feat/saas/GH-1393-disable-private-keys-ibm-auth-enabled
branch
from
5faf2a9 to
3b611a2
Compare
github-actions
Bot
added
enhancement
Issue - #1393 Summary - Disabled JWT key generation and local token signing/verification when `IBM_AUTH_ENABLED` is true, delegating all authentication to Traefik in IBM/SaaS deployments. Session Manager Updates - Imported `IBM_AUTH_ENABLED` at module level in `session_manager.py` instead of inside individual methods. - Set `private_key`, `public_key`, `public_key_pem`, and `algorithm` to `None` when IBM auth mode is active and no explicit signing key is configured (RSA key loading skipped). - Guarded `create_jwt_token` to return `None` early and log an error when `private_key` is `None` (IBM auth mode). - Guarded `verify_token` to return `None` immediately when `IBM_AUTH_ENABLED` is set, since token verification is handled externally by Traefik. - Guarded `get_effective_jwt_token` to return `None` when `private_key` is `None`, preventing anonymous JWT creation in IBM auth mode. Startup / Key Generation Updates - Skipped `generate_jwt_keys()` call in `initialize_services()` when `IBM_AUTH_ENABLED` is true, preventing unnecessary RSA key file creation in IBM/SaaS deployments.
mpawlow
force-pushed
the
mp/feat/saas/GH-1393-disable-private-keys-ibm-auth-enabled
branch
from
3b611a2 to
d33e1a4
Compare
github-actions
Bot
added
enhancement
edwinjosechittilappilly
approved these changes
Apr 21, 2026
Collaborator
edwinjosechittilappilly
left a comment
edwinjosechittilappilly
left a comment
There was a problem hiding this comment.
LGTM, merge only after testing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Related Pull Requests
main: feat: Disable use of private / public keys when IBM_AUTH_ENABLED is true #1410Summary
IBM_AUTH_ENABLEDis true, delegating all authentication to Traefik in IBM/SaaS deployments.Session Manager Updates
IBM_AUTH_ENABLEDat module level insession_manager.pyinstead of inside individual methods.private_key,public_key,public_key_pem, andalgorithmtoNonewhen IBM auth mode is active and no explicit signing key is configured (RSA key loading skipped).create_jwt_tokento returnNoneearly and log an error whenprivate_keyisNone(IBM auth mode).verify_tokento returnNoneimmediately whenIBM_AUTH_ENABLEDis set, since token verification is handled externally by Traefik.get_effective_jwt_tokento returnNonewhenprivate_keyisNone, preventing anonymous JWT creation in IBM auth mode.Startup / Key Generation Updates
generate_jwt_keys()call ininitialize_services()whenIBM_AUTH_ENABLEDis true, preventing unnecessary RSA key file creation in IBM/SaaS deployments.