Current Limitation
The local Docker Compose stack has no bundled Identity Provider. Every service that verifies JWTs — Orchestration Engine (internal/oe/auth), Policy Decision Point (internal/pdp/config), Consent Engine (internal/ce/config), and Portal Backend (internal/pb/v1/handlers) — expects IDP_* environment variables (issuer, audience, JWKS URL, and for CE/PB also client ID/secret) pointing at an external IdP that must be stood up and configured by hand. docker compose up --build alone is not enough to exercise the full request/consent flow or log into the portals.
Notably, PDP's config already defaults IDP_JWKS_URL to https://localhost:8090/oauth2/jwks (internal/pdp/config/config.go), i.e. it already assumes a Thunder-shaped local IdP on port 8090 — the wiring is half-anticipated but never completed.
Suggested Improvement
- Add a ThunderID service (https://github.com/thunder-id/thunderid) to the root
docker-compose.yml, using its documented quick-start compose config as a base, exposed on localhost:8090.
- Pre-provision a client/application, issuer, and audience for local dev (via Thunder's bootstrap/seed mechanism if available, or a documented manual step).
- Wire up each service's
IDP_* variables in .env.example to point at the bundled Thunder instance:
- OE:
expectedIssuer / validAudiences / JWKS URL in cmd/oe/config.docker.json.
- PDP:
IDP_ISSUER, IDP_AUDIENCE, IDP_JWKS_URL.
- CE:
IDP_ISSUER, IDP_AUDIENCE, IDP_JWKS_URL, IDP_CLIENT_ID, IDP_SUBJECT_CLAIM.
- PB:
IDP_BASE_URL, IDP_JWKS_URL, IDP_ISSUER, IDP_TOKEN_URL, IDP_CLIENT_ID, IDP_CLIENT_SECRET, IDP_SCOPE.
- Add a
depends_on from each auth-dependent service to the Thunder container, and a healthcheck so services don't race Thunder's startup.
- Update the README's "Prerequisites" / IdP setup instructions to note that the bundled stack now includes a working local IdP out of the box, with external IdPs (Asgardeo, Keycloak, Auth0) remaining supported for non-local environments.
Version
4824602 (main)
Additional Context
Follow-up to #536 / PR #537 (moved the local dev Docker Compose stack to the repo root). Scoped out of that PR to keep it a pure file-layout change; this issue tracks the actual IdP integration work.
Current Limitation
The local Docker Compose stack has no bundled Identity Provider. Every service that verifies JWTs — Orchestration Engine (
internal/oe/auth), Policy Decision Point (internal/pdp/config), Consent Engine (internal/ce/config), and Portal Backend (internal/pb/v1/handlers) — expectsIDP_*environment variables (issuer, audience, JWKS URL, and for CE/PB also client ID/secret) pointing at an external IdP that must be stood up and configured by hand.docker compose up --buildalone is not enough to exercise the full request/consent flow or log into the portals.Notably, PDP's config already defaults
IDP_JWKS_URLtohttps://localhost:8090/oauth2/jwks(internal/pdp/config/config.go), i.e. it already assumes a Thunder-shaped local IdP on port 8090 — the wiring is half-anticipated but never completed.Suggested Improvement
docker-compose.yml, using its documented quick-start compose config as a base, exposed onlocalhost:8090.IDP_*variables in.env.exampleto point at the bundled Thunder instance:expectedIssuer/validAudiences/ JWKS URL incmd/oe/config.docker.json.IDP_ISSUER,IDP_AUDIENCE,IDP_JWKS_URL.IDP_ISSUER,IDP_AUDIENCE,IDP_JWKS_URL,IDP_CLIENT_ID,IDP_SUBJECT_CLAIM.IDP_BASE_URL,IDP_JWKS_URL,IDP_ISSUER,IDP_TOKEN_URL,IDP_CLIENT_ID,IDP_CLIENT_SECRET,IDP_SCOPE.depends_onfrom each auth-dependent service to the Thunder container, and a healthcheck so services don't race Thunder's startup.Version
4824602 (main)
Additional Context
Follow-up to #536 / PR #537 (moved the local dev Docker Compose stack to the repo root). Scoped out of that PR to keep it a pure file-layout change; this issue tracks the actual IdP integration work.