fix(auth): add jwks_uri column to SSOProvider and harden create_provider#3026
Merged
crivetimihai merged 3 commits intomainfrom Feb 18, 2026
Merged
fix(auth): add jwks_uri column to SSOProvider and harden create_provider#3026crivetimihai merged 3 commits intomainfrom
crivetimihai merged 3 commits intomainfrom
Conversation
Add jwks_uri as a first-class column on SSOProvider for standard OIDC JWKS endpoint support. Make create_provider defensive by filtering unknown keys to prevent TypeError crashes during SSO bootstrap. Closes #3010 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
3ef8fe6 to
0d90fd4
Compare
… setting Update _schema_looks_current() to check for sso_providers.jwks_uri, preventing unversioned databases from being stamped at head without the new column. Add SSO_GENERIC_JWKS_URI to .env.example. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
KKNithin
pushed a commit
to KKNithin/mcp-context-forge
that referenced
this pull request
Feb 19, 2026
…der (IBM#3026) * fix(auth): add jwks_uri column to SSOProvider and harden create_provider Add jwks_uri as a first-class column on SSOProvider for standard OIDC JWKS endpoint support. Make create_provider defensive by filtering unknown keys to prevent TypeError crashes during SSO bootstrap. Closes IBM#3010 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): include jwks_uri in bootstrap_db schema check and document setting Update _schema_looks_current() to check for sso_providers.jwks_uri, preventing unversioned databases from being stamped at head without the new column. Add SSO_GENERIC_JWKS_URI to .env.example. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * lint Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Signed-off-by: Nithin Katta <Nithin.Katta@ibm.com>
crivetimihai
added a commit
that referenced
this pull request
Feb 24, 2026
…der (#3026) * fix(auth): add jwks_uri column to SSOProvider and harden create_provider Add jwks_uri as a first-class column on SSOProvider for standard OIDC JWKS endpoint support. Make create_provider defensive by filtering unknown keys to prevent TypeError crashes during SSO bootstrap. Closes #3010 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): include jwks_uri in bootstrap_db schema check and document setting Update _schema_looks_current() to check for sso_providers.jwks_uri, preventing unversioned databases from being stamped at head without the new column. Add SSO_GENERIC_JWKS_URI to .env.example. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * lint Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Signed-off-by: Nithin Katta <Nithin.Katta@ibm.com>
cafalchio
pushed a commit
that referenced
this pull request
Feb 26, 2026
…der (#3026) * fix(auth): add jwks_uri column to SSOProvider and harden create_provider Add jwks_uri as a first-class column on SSOProvider for standard OIDC JWKS endpoint support. Make create_provider defensive by filtering unknown keys to prevent TypeError crashes during SSO bootstrap. Closes #3010 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(auth): include jwks_uri in bootstrap_db schema check and document setting Update _schema_looks_current() to check for sso_providers.jwks_uri, preventing unversioned databases from being stamped at head without the new column. Add SSO_GENERIC_JWKS_URI to .env.example. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * lint Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
jwks_urias a first-class optional column onSSOProvidermodel with Alembic migration, resolving theTypeError: 'jwks_uri' is an invalid keyword argument for SSOProvidercrash during SSO bootstrap with KeycloakSSOService.create_provider()defensive by filtering provider data to valid column names, preventing any unknown key from crashing the bootstrapsso_generic_jwks_uriconfig setting and update router schemas (SSOProviderCreateRequest,SSOProviderUpdateRequest,SSOProviderResponse) to supportjwks_uriCloses #3010
Test plan
SSOProvideracceptingjwks_uri,create_providerhandling unknown keys, and generic OIDCjwks_urisupportjwks_uriin mock fixtures