You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by "nagisa-kunhah (via GitHub)" <gi...@apache.org> on 2026/10/18 04:34:29 UTC
[PR] feat(ai): add optional JWT authentication with Admin-issued access tokens [dubbo-admin]
nagisa-kunhah opened a new pull request, #1600:
URL: https://github.com/apache/dubbo-admin/pull/1600
**Please provide a description of this PR:**
Add optional JWT authentication to the independent AI service, using the existing Admin login session to obtain short-lived access tokens.
- Admin exposes a session-protected `POST /api/v1/auth/token` endpoint to issue RS256-signed JWTs and a public `GET /api/v1/auth/jwks` endpoint to publish the verification keys.
- AI authentication middleware validates Bearer tokens against Admin's JWKS, including signature, issuer, audience, expiration, issued-at, and subject checks. Missing or invalid tokens return HTTP 401 with a `WWW-Authenticate: Bearer` header.
- The frontend keeps access tokens in runtime memory, attaches them to AI requests, renews them before expiration, and retries once after a Bearer authentication challenge.
- Admin token issuance and AI authentication are explicitly enabled through YAML configuration. Admin requires a persistent RSA private key when token issuance is enabled.
- Existing Admin session authentication, MCP API Key authentication, and AI session storage behavior are preserved.
This change does not introduce RBAC, user-specific AI session isolation, or immediate JWT revocation on logout.
**AI token authentication flow**
Prerequisite: the user already has a valid Admin session. Existing login flows are handled by Admin and are omitted here. The diagram assumes both Admin token issuance and AI JWT authentication are enabled.
```mermaid
sequenceDiagram
participant UI as Frontend
participant API as Admin API
participant AI as AI service
Note over API: Holds RSA private key
AI->>API: GET /api/v1/auth/jwks
API-->>AI: Public keys (JWKS)
Note over AI: Cache keys at startup and refresh when needed
UI->>API: POST /api/v1/auth/token + Session Cookie
API-->>UI: Short-lived RS256 access JWT
Note over UI: Store JWT only in runtime memory
UI->>AI: /api/v1/ai/* + Authorization: Bearer JWT
Note over AI: Verify signature and claims locally
AI-->>UI: Valid JWT returns API response / SSE, invalid or missing JWT returns 401
```
Admin validates the existing session before issuing a token. AI uses cached public keys to verify tokens locally, without contacting Admin for every request. The frontend renews tokens before expiry and retries once after a Bearer 401 challenge. The private key stays on Admin.
**Validation**
- Admin: `go test ./...` — passed.
- AI: `go test ./...` — passed.
- Frontend: `yarn test:unit --run` — all 64 tests passed.
- Frontend: `yarn vite build` — passed.
- `git diff --check` — passed.
**Manual verification with curl**
Verified locally with Admin on port `8888`, AI on port `8880`, and JWT signing and verification enabled in both services. The commands below use local test credentials and require `jq`.
1. Log in to Admin and save the session cookie:
```bash
COOKIE_FILE=$(mktemp)
curl -sS -c "$COOKIE_FILE" \
-X POST http://localhost:8888/api/v1/auth/login \
--data-urlencode 'user=admin' \
--data-urlencode 'password=dubbo@2025'
```
Observed response:
```json
{"code":"Success","message":"success","data":true}
```
2. Obtain an AI access token using the Admin session:
```bash
TOKEN=$(curl -fsS -b "$COOKIE_FILE" \
-X POST http://localhost:8888/api/v1/auth/token \
| jq -er '.data.accessToken')
```
Token issuance succeeded. The JWT value is omitted from this report.
3. Call the AI sessions endpoint with the Bearer token:
```bash
curl -i http://localhost:8880/api/v1/ai/sessions \
-H "Authorization: Bearer $TOKEN"
```
Observed: **HTTP 200 OK**, with a successful session-list response.
4. Call the same endpoint without a token:
```bash
curl -i http://localhost:8880/api/v1/ai/sessions
```
Observed response, with unrelated headers omitted:
```http
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer
Content-Type: application/json; charset=utf-8
{"error":"invalid or missing bearer token"}
```
Additional requests verified against the integrated version:
| Request to the AI sessions endpoint | Observed result |
| --- | --- |
| Valid Bearer JWT | HTTP 200 |
| No token | HTTP 401 |
| Invalid Bearer token | HTTP 401 |
| Admin session cookie only | HTTP 401 |
These checks verify the Admin-session-to-JWT flow and AI endpoint authentication. They do not verify model generation, which depends on the configured model provider and account status.
Optional cleanup:
```bash
rm -- "$COOKIE_FILE"
unset COOKIE_FILE TOKEN
```
**To help us figure out who should review this PR, please put an X in all the areas that this PR affects.**
- [ ] Docs
- [X] Installation
- [X] User Experience
- [ ] Dubboctl
- [X] Console
- [X] Core Component
**Please check any characteristics that apply to this pull request.**
- [X] Adds optional authentication functionality
- [X] Changes security-sensitive behavior
- [X] Adds YAML configuration and schema validation
- [X] Adds backend and frontend tests
- [X] Preserves anonymous AI access when authentication is disabled
- [ ] Requires a data migration
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(ai): add optional JWT authentication with Admin-issued access tokens [dubbo-admin]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1600:
URL: https://github.com/apache/dubbo-admin/pull/1600#issuecomment-6381719903
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-admin&pullRequest=1600) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-admin&pullRequest=1600&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-admin&pullRequest=1600&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-admin&pullRequest=1600)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(ai): add optional JWT authentication with Admin-issued access tokens [dubbo-admin]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1600:
URL: https://github.com/apache/dubbo-admin/pull/1600#issuecomment-6245698511
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-admin&pullRequest=1600) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-admin&pullRequest=1600&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-admin&pullRequest=1600&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-admin&pullRequest=1600)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(ai): add optional JWT authentication with Admin-issued access tokens [dubbo-admin]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1600:
URL: https://github.com/apache/dubbo-admin/pull/1600#issuecomment-6383297802
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-admin&pullRequest=1600) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-admin&pullRequest=1600&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-admin&pullRequest=1600&metric=new_coverage&view=list)
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-admin&pullRequest=1600&metric=new_duplicated_lines_density&view=list)
<!-- sqra-placement-anchor -->
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-admin&pullRequest=1600)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(ai): add optional JWT authentication with Admin-issued access tokens [dubbo-admin]
Posted by "nagisa-kunhah (via GitHub)" <gi...@apache.org>.
nagisa-kunhah commented on PR #1600:
URL: https://github.com/apache/dubbo-admin/pull/1600#issuecomment-6381740601
> ## 需要修（P1）
>
> **未知 `kid` 会为每个请求发起一次出站 HTTP，且没有冷却窗口。** `ai/component/server/engine/auth.go:105-125`：
>
> ```go
> v.mu.RLock()
> key := v.keys[kid]
> v.mu.RUnlock()
> if key != nil { return key, nil }
> if err := v.refresh(context.Background()); err != nil { // ← 缓存未命中就远程取
> return nil, err
> }
> ```
>
> `kid` 来自**未验证**的 JWT header（`token.Header["kid"]`，此时签名尚未校验）。任何人都可以构造 `{"alg":"RS256","kid":"<随机串>"}` 的 token 打 `POST /api/v1/ai/chat/stream`，服务端就会向 Admin 的 JWKS 端点发一次 GET。放大比 1:1，既没有单飞（singleflight）合并、也没有最小重取间隔，`context.Background()` 还让这次调用脱离了请求的取消与截止时间（只有 `NewJWKSClient` 里的 10s 超时兜底）。
fix，增加了ttl机制，并发请求通过notify机制避免缓存击穿风险。
与1609的冲突服从社区安排。
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org