feat: Add optional OIDC token audience and issuer verification by larrysingleton007 · Pull Request #6670 · feast-dev/feast

larrysingleton007 · 2026-07-30T13:57:30Z

What this PR does / why we need it

Adds optional audience and issuer verification to the OIDC token parser. Today the parser verifies signature and expiry only, so any validly-signed, unexpired token from the configured IdP authenticates regardless of which resource it was minted for; RBAC role matching is the only remaining gate.

Two new OidcAuthConfig fields, audience and issuer, both unset by default:

auth:
  type: oidc
  client_id: _CLIENT_ID_
  auth_discovery_url: https://login.example.com/.well-known/openid-configuration
  audience: api://feast-feature-server
  issuer: https://login.example.com/realms/master

When set, jwt.decode runs with verify_aud / verify_iss enabled against the configured values, and a mismatched or missing claim rejects the token at authentication. When unset, the decode options are identical to before, so existing deployments see no behavior change; all pre-existing tests are untouched and passing.

Opt-in rather than strict-by-default because IdPs commonly mint tokens whose claims differ from their discovery metadata. Entra ID issues v1.0 tokens (iss under sts.windows.net, api:// audience) that are routinely validated against a v2.0 discovery URL, which works because discovery is only used to source JWKS keys. test_oidc_default_supports_v1_tokens_against_v2_discovery pins that setup so a future refactor cannot silently regress it. Operators state expected values explicitly rather than the code inferring them from the discovery document, for the same reason.

Testing: 11 new unit tests. Config-to-decode fidelity (the verified decode enables exactly the checks the config provides), end-to-end RS256-signed tokens through the real jwt.decode (match accepted, mismatch rejected, missing claim rejected, default permissive), and the v1/v2 pin. tests/unit/permissions: 307 passing; ruff and mypy clean on the changed files.

Docs: the OIDC section of authz_manager.md documents the new options and warns that expected values must match the token's claims, not the discovery document.

Not included: the feast-operator's OIDC secret-key whitelist (OidcOptionalSecretProperties) does not yet pass audience/issuer through to the generated feature_store.yaml. Happy to follow up separately if there is interest in exposing these via the operator CRD.

Which issue(s) this PR fixes

Fixes #6669

codecov-commenter · 2026-07-30T14:16:11Z

⚠️ Please install the $'codecov app svg image'$ to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.44%. Comparing base (181eb35) to head (67074d0).
⚠️ Report is 1 commits behind head on master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

$Impacted file tree graph$

@@           Coverage Diff           @@
##           master    #6670   +/-   ##
=======================================
  Coverage   46.44%   46.44%           
=======================================
  Files         414      414           
  Lines       50134    50134           
  Branches     7173     7173           
=======================================
  Hits        23285    23285           
  Misses      25212    25212           
  Partials     1637     1637

Flag	Coverage Δ		*Carryforward flag
go-feature-server	`30.58% <ø> (ø)`
python-unit	`47.75% <ø> (ø)`		Carriedforward from 181eb35

*This pull request uses carry forward flags. Click here to find out more.

Files with missing lines	Coverage Δ
...python/feast/permissions/auth/oidc_token_parser.py	`65.89% <ø> (ø)`
sdk/python/feast/permissions/auth_model.py	`100.00% <ø> (ø)`

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 181eb35...67074d0. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ntkathole

Let's have it in operator as well

larrysingleton007 · 2026-07-30T15:02:41Z

Thanks for the quick review. Operator follow-up PR coming right up: adding audience and issuer to the OIDC secret property whitelist so they flow into the generated feature_store.yaml auth section, plus tests.

larrysingleton007 · 2026-07-30T15:14:10Z

Operator follow-up is tracked in #6676 and the change is ready on my side (whitelist additions for audience and issuer in the OIDC Secret, tests, and docs; verify_ssl and ca_cert_path stay CR fields since they already flow through the CRD). One question on sequencing: happy for this one to merge now with the operator PR following right behind, or would you rather hold it and land the two together? Either works for me.

ntkathole · 2026-07-30T15:24:07Z

will merge this, @aniketpalu fyi

The OIDC token parser verifies signature (JWKS via discovery) and expiry, but never the audience or issuer: any validly-signed, unexpired token from the configured IdP authenticates regardless of which resource it was minted for, leaving RBAC role matching as the only gate. Add two optional OidcAuthConfig fields, audience and issuer, both unset by default. When set, the corresponding claim must match or the token is rejected at authentication; when unset, the decode options are identical to before, so existing deployments are unaffected. Opt-in rather than strict-by-default because IdPs commonly mint tokens whose claims differ from the discovery metadata: Entra ID issues v1.0 tokens (iss under sts.windows.net, api:// audience) that are validated against a v2.0 discovery URL, which works because discovery is used only to source JWKS keys. A dedicated test pins that setup so it cannot silently regress. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

Cover the new audience and issuer options in the OIDC authorization page, including the caveat that expected values must match the token's claims rather than the discovery document (the Entra ID v1.0-token case). Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

Follow-up to feast-dev#6670, requested in review: add audience and issuer to OidcOptionalSecretProperties so operators can set them in the referenced OIDC Secret and have them flow into the generated feature_store.yaml auth section, enabling the new opt-in claim verification on the feature server. Absent keys change nothing. Documents the two optional Secret keys in the operator security guide with a pointer to the OIDC authorization page for the token-claims vs discovery-metadata caveat. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

) * feat: Pass optional OIDC audience and issuer through the operator Follow-up to #6670, requested in review: add audience and issuer to OidcOptionalSecretProperties so operators can set them in the referenced OIDC Secret and have them flow into the generated feature_store.yaml auth section, enabling the new opt-in claim verification on the feature server. Absent keys change nothing. Documents the two optional Secret keys in the operator security guide with a pointer to the OIDC authorization page for the token-claims vs discovery-metadata caveat. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * fix: Coerce numeric OIDC audience and issuer Secret values to strings Secret values are YAML-parsed on extraction, so an all-digits audience (e.g. a numeric IdP application ID) arrives as a Go int, renders unquoted in the generated feature_store.yaml, and fails the SDK's Optional[str] validation at server startup. Coerce the two claim keys back to strings in the allowlist copy, with a regression test. Also extend the reconcile-level envtest fixtures with both keys so they exercise real Secret extraction and YAML serialization rather than only the mocked property map. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * docs: Sharpen operator OIDC audience/issuer docs and fix dead links State precisely which claims are and are not checked, scope the checks to the standard OIDC/JWKS path (ServiceAccount and intra-server tokens follow separate paths), distinguish the Secret's issuer key from the CR's issuerUrl, and document three operational caveats: pre-existing Secret keys activate on operator upgrade, the IdP must mint matching claims for Feast's own client token flows, and Secret edits apply on the next reconcile. Point the two dead ../reference/auth links at real pages and add the new optional keys to the linked sample Secret as commented lines. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --------- Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

…-dev#6670) * feat: Add optional OIDC token audience and issuer verification The OIDC token parser verifies signature (JWKS via discovery) and expiry, but never the audience or issuer: any validly-signed, unexpired token from the configured IdP authenticates regardless of which resource it was minted for, leaving RBAC role matching as the only gate. Add two optional OidcAuthConfig fields, audience and issuer, both unset by default. When set, the corresponding claim must match or the token is rejected at authentication; when unset, the decode options are identical to before, so existing deployments are unaffected. Opt-in rather than strict-by-default because IdPs commonly mint tokens whose claims differ from the discovery metadata: Entra ID issues v1.0 tokens (iss under sts.windows.net, api:// audience) that are validated against a v2.0 discovery URL, which works because discovery is used only to source JWKS keys. A dedicated test pins that setup so it cannot silently regress. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * docs: Document optional OIDC audience and issuer verification Cover the new audience and issuer options in the OIDC authorization page, including the caveat that expected values must match the token's claims rather than the discovery document (the Entra ID v1.0-token case). Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --------- Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

…ast-dev#6677) * feat: Pass optional OIDC audience and issuer through the operator Follow-up to feast-dev#6670, requested in review: add audience and issuer to OidcOptionalSecretProperties so operators can set them in the referenced OIDC Secret and have them flow into the generated feature_store.yaml auth section, enabling the new opt-in claim verification on the feature server. Absent keys change nothing. Documents the two optional Secret keys in the operator security guide with a pointer to the OIDC authorization page for the token-claims vs discovery-metadata caveat. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * fix: Coerce numeric OIDC audience and issuer Secret values to strings Secret values are YAML-parsed on extraction, so an all-digits audience (e.g. a numeric IdP application ID) arrives as a Go int, renders unquoted in the generated feature_store.yaml, and fails the SDK's Optional[str] validation at server startup. Coerce the two claim keys back to strings in the allowlist copy, with a regression test. Also extend the reconcile-level envtest fixtures with both keys so they exercise real Secret extraction and YAML serialization rather than only the mocked property map. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * docs: Sharpen operator OIDC audience/issuer docs and fix dead links State precisely which claims are and are not checked, scope the checks to the standard OIDC/JWKS path (ServiceAccount and intra-server tokens follow separate paths), distinguish the Secret's issuer key from the CR's issuerUrl, and document three operational caveats: pre-existing Secret keys activate on operator upgrade, the IdP must mint matching claims for Feast's own client token flows, and Secret edits apply on the next reconcile. Point the two dead ../reference/auth links at real pages and add the new optional keys to the linked sample Secret as commented lines. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --------- Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

# [0.66.0](v0.65.0...v0.66.0) (2026-08-21) ### Bug Fixes * Add connection pre-warming for DynamoDB async client ([89240fa](89240fa)), closes [#6060](#6060) * Add remote registry client extra ([#6697](#6697)) ([b8dfcb0](b8dfcb0)) * Address review feedback on FIPS cipher suite configuration ([4a35fba](4a35fba)) * Allow remote-registry first apply for new projects ([39d408d](39d408d)) * Avoid importing feast.feature_store at mcp_server import time ([ddb2e9a](ddb2e9a)) * Bump pymssql to >=2.3.6 for macOS arm64 wheel support ([181eb35](181eb35)), closes [#5636](#5636) [#5193](#5193) [#5636](#5636) * Call ApplySavedDataset RPC instead of ApplyFeatureService in RemoteRegistry.apply_saved_dataset() ([934d341](934d341)) * Catch missing dbt parser dependency in dbt CLI commands ([#6534](#6534)) ([3c2ae3c](3c2ae3c)) * Default authentication to kubernetes auth ([6a4690a](6a4690a)) * Defer feature-freshness thread to post-fork to avoid Gunicorn deadlock ([#6648](#6648)) ([104ad10](104ad10)), closes [#6647](#6647) * Do not pass undeclared feature view columns to ODFV UDFs ([#6527](#6527)) ([75b9463](75b9463)) * downgrade mcp pin to 1.29.0 and fix CI lockfiles and unit tests ([98e5bca](98e5bca)), closes [#6706](#6706) * Feast apply silently ignoring ttl updates to None or timedelta(0) ([#6709](#6709)) ([97b0f25](97b0f25)), closes [#6703](#6703) * Fix mypy TorchTensor type alias error ([#6712](#6712)) ([34de6fa](34de6fa)), closes [#5563](#5563) * Fixed data source creation form gaps ([5d0f7d6](5d0f7d6)) * Handle parameterized and complex Trino types in type map ([326554d](326554d)) * Isolate default user permissions ([e37adbf](e37adbf)) * Isolate projection join key maps ([d1c709d](d1c709d)) * Map Postgres real to FLOAT instead of DOUBLE ([62db435](62db435)) * Merge shared ODFV source projections in feature resolution ([d269946](d269946)), closes [#6621](#6621) * More exhaustive athena types ([a9aaefc](a9aaefc)) * Normalize SQL registry read_path to the psycopg3 driver like path ([#6644](#6644)) ([996c6ea](996c6ea)), closes [#6643](#6643) * **operator:** add spec.services.onlineStore.disabled to opt out of the online store ([d81d4e3](d81d4e3)), closes [#6586](#6586) * Preinstall DuckDB delta extension for tests ([fd4d49d](fd4d49d)), closes [#6743](#6743) * Preserve event-time ordering within Redis online_write_batch ([40fb788](40fb788)), closes [#5163](#5163) * Prevent mutation of cached feature resolution results ([ea17419](ea17419)) * Remote feastRef FeatureStore fails first apply for a new feastProject ([9affee5](9affee5)) * Remove inert subjectaccessreviews and reorganize RBAC rules ([f771ea4](f771ea4)) * Report single-feature-view spark_application materialization success ([a9219d9](a9219d9)), closes [#6673](#6673) * Reset the global security manager after the permissions fixture ([7667215](7667215)) * Resolve kserve with pip --dry-run instead of installing it ([01da132](01da132)), closes [#6732](#6732) * Resolve write_to_offline_store feature view with a single registry lookup ([a42dc85](a42dc85)), closes [#4235](#4235) * Return False from __eq__ on cross-type comparison ([#6637](#6637)) ([0f149a9](0f149a9)), closes [#6636](#6636) * Reuse IdP-issued client tokens until near expiry ([602d752](602d752)) * Reuse the OIDC JWKS client across requests ([#6683](#6683)) ([a1e6fc2](a1e6fc2)) * Separate CronJob and feature-server ServiceAccounts ([398f643](398f643)) * Serialize UnixTimestamp proto values as raw int64 in remote online store transport ([1e7134f](1e7134f)) * Set FIPS cipher suites before pyarrow.flight import to prevent crash on IBM Power ([979b82a](979b82a)) * Support Entra ID (Azure AD) token claims in OIDC auth ([#6631](#6631)) ([f843c63](f843c63)) * UDF/ODFV source rehydrate (+ Postgres / online cache) ([#6655](#6655)) ([5fd7af7](5fd7af7)) * Updated projects-list.json in order to display newly added projects ([#6657](#6657)) ([3a6a103](3a6a103)) * Use correct image name in multi-arch imagetools push step ([faf85e0](faf85e0)) * Use join keys instead of entity names in ODFV materialization ([#6645](#6645)) ([abffebc](abffebc)), closes [#5965](#5965) * use matching proto class per feature view list in SqliteOnlineStore.plan() ([adb8c1c](adb8c1c)), closes [#6658](#6658) * Widen Athena integer type mapping for unsigned ints ([3425783](3425783)) ### Features * Add ConnectionRef to DataSource for pluggable external credential resolution ([28bde01](28bde01)) * Add Feature Service Create in UI ([0399380](0399380)) * Add hybrid to ValidOfflineStoreDBStorePersistenceTypes for HybridOfflineStore support ([#6707](#6707)) ([310ab51](310ab51)), closes [#6701](#6701) * Add MLflow integration support to Feast operator ([#6611](#6611)) ([52999f1](52999f1)) * Add opt-in filter_by_created_timestamp cutoff to get_historical_features ([#6617](#6617)) ([79b33ce](79b33ce)), closes [#6615](#6615) * Add optional OIDC token audience and issuer verification ([#6670](#6670)) ([ef307c6](ef307c6)) * Add packaged feature repository support to Feast Operator ([8112b1e](8112b1e)), closes [#6598](#6598) * add plan() support to DynamoDBOnlineStore ([51ce982](51ce982)), closes [#6658](#6658) [#6659](#6659) * Added optional namespace/colleciton to datasets ([165fcf2](165fcf2)) * Added SQL registry schema_mode and registry create command ([#6704](#6704)) ([037c4cd](037c4cd)) * Allow users to have protected project on shared registry ([f9923bc](f9923bc)) * Apply Intermediate TLS defaults on API fallback and handle transient errors ([#6587](#6587)) ([43ae993](43ae993)) * **cli:** Updated feast init demo by adding rag template ([#5946](#5946)) ([c8628eb](c8628eb)), closes [#5264](#5264) * Expose the OIDC JWKS tunables through the operator ([#6690](#6690)) ([fef4e78](fef4e78)), closes [#6683](#6683) * Making feast vector store with open ai search api compatible ([#6121](#6121)) ([54da19a](54da19a)) * Multi-arch publish for feast operator image ([b221036](b221036)) * OpenLineage lineage enhancements - full object coverage, richer UI, and API-level sync ([#6719](#6719)) ([120a868](120a868)) * **operator:** Add spec.services.initImage for init container image override ([#6598](#6598)) ([ca355cb](ca355cb)) * Pass optional OIDC audience and issuer through the operator ([#6677](#6677)) ([a13ed7b](a13ed7b)), closes [#6670](#6670) * **server:** Remote Materialization ([#6649](#6649)) ([b7ae488](b7ae488)), closes [#4526](#4526) * Support Lineage configs via operator ([bf1e54a](bf1e54a)) * Updated datasets UI to support grouping ([7ae64ec](7ae64ec))

$@larrysingleton007$

larrysingleton007 requested a review from a team as a code owner July 30, 2026 13:57

$@ntkathole$ ntkathole added the ok-to-test label Jul 30, 2026

$ntkathole$

ntkathole approved these changes Jul 30, 2026

View reviewed changes

$@larrysingleton007$ larrysingleton007 mentioned this pull request Jul 30, 2026

Expose optional OIDC audience and issuer verification through the feast-operator #6676

Closed

larrysingleton007 added 2 commits July 30, 2026 20:54

$@ntkathole$

ntkathole force-pushed the feat/oidc-optional-audience-issuer-verification branch from fad9e3b to 67074d0 Compare July 30, 2026 15:24

$@ntkathole$

ntkathole merged commit ef307c6 into feast-dev:master Jul 30, 2026
17 of 22 checks passed

$@larrysingleton007$ larrysingleton007 mentioned this pull request Jul 30, 2026

feat: Pass optional OIDC audience and issuer through the operator #6677

Merged

$@larrysingleton007$

larrysingleton007 deleted the feat/oidc-optional-audience-issuer-verification branch July 30, 2026 15:30

$@larrysingleton007$ larrysingleton007 mentioned this pull request Jul 31, 2026

fix: Reuse the OIDC JWKS client across requests #6683

Merged

Navigation Menu

Uh oh!

feat: Add optional OIDC token audience and issuer verification - #6670

feat: Add optional OIDC token audience and issuer verification#6670
ntkathole merged 2 commits into
feast-dev:masterfrom
larrysingleton007:feat/oidc-optional-audience-issuer-verification

$@larrysingleton007$ larrysingleton007 commented Jul 30, 2026

Uh oh!

codecov-commenter commented Jul 30, 2026 •

edited

Loading

Uh oh!

$@ntkathole$ ntkathole left a comment

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

ntkathole commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

larrysingleton007 commented Jul 30, 2026

What this PR does / why we need it

Which issue(s) this PR fixes

Uh oh!

codecov-commenter commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ntkathole left a comment

Choose a reason for hiding this comment

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

ntkathole commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

$@larrysingleton007$ larrysingleton007 commented Jul 30, 2026

codecov-commenter commented Jul 30, 2026 •

edited

Loading

$@ntkathole$ ntkathole left a comment