kevinveenbirkenbachandClaude Opus 5 b764b00ba3 fix(keycloak): forward the access token only to consumers that read it ...

The SSO gate handed X-Forwarded-Access-Token to every oauth2-fronted upstream, so each of the 28 gated roles received a full-scope bearer for the signed-in user while exactly one, n8n, decodes it. The token also grows with the realm's registered origins, and LAM's Apache rejects a header field above 8190 bytes (Moodle#0, run 33689701895).

Consumers now declare services.sso.oauth2.pass_access_token. Without it oauth2-proxy already answers the auth request without the token, and the gate blanks the upstream header rather than dropping the directive, because nginx inherits proxy_set_header as an array and an unset header would let a client-supplied one through. The new lint keeps declaration and use in step in both directions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 09:20:19 +02:00

..

action

perf(applications): render the applications SPOT once per play instead of once per task

2026-09-02 23:55:32 +02:00

filter

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

lookup

fix(keycloak): forward the access token only to consumers that read it

2026-09-03 09:20:19 +02:00

__init__.py

…