Forte/launchpad
6
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Wiki Activity

feat(auth-sidecar): inject AUTH_OIDC_ALLOWED_RETURN_HOSTS
/ test (pull_request) Successful in 8s
Details

Browse Source 
Reads the new `policies.forteapps.io/auth-oidc-allowed-return-hosts` pod
annotation into the OIDC sidecar's AUTH_OIDC_ALLOWED_RETURN_HOSTS env var
(mirrors the existing cookie-domain wiring). Enables origin-preserving
post-login redirects so a login that round-trips through a shared apex
callback returns the user to the originating subdomain.

Absent annotation => empty => unchanged path-only redirect, so all other
apps injected by this policy are unaffected. Requires auth-sidecar >= v1.5.0
(Forte/auth-sidecar#24) and the matching forteapp chart annotation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sten
2026-07-01 15:47:45 +02:00
parent df35cd0630
commit eeabe8f49b
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cluster-resources/policies/auth-sidecar-injector.yaml
+2
View File
@@ -235,6 +235,8 @@ spec:
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-scopes\" || 'openid,profile,email' }}"
- name: AUTH_OIDC_COOKIE_DOMAIN
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-cookie-domain\" || '' }}"
- name: AUTH_OIDC_ALLOWED_RETURN_HOSTS
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-allowed-return-hosts\" || '' }}"
- name: AUTH_PUBLIC_PATHS
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
- name: AUTH_OIDC_COOKIE_SECRET