Skip to content

Add configuration to skip copying assertion audience in JWT bearer grant type#4076

Open
elatt wants to merge 7 commits intoory:masterfrom
datarobot-forks:elatt/jwt-bearer-audience
Open

Add configuration to skip copying assertion audience in JWT bearer grant type#4076
elatt wants to merge 7 commits intoory:masterfrom
datarobot-forks:elatt/jwt-bearer-audience

Conversation

@elatt
Copy link
Copy Markdown
Contributor

@elatt elatt commented Mar 4, 2026

Introduce a configuration option to control whether the audience from the assertion JWT is copied into the resulting access token in the JWT bearer grant type. By default, this behavior remains enabled. The implementation includes updates to the configuration interface, handler logic, and tests to ensure expected functionality.

Comment on lines +164 to +166
// GrantTypeJWTBearerCopyAssertionAudience indicates whether the audience from the assertion JWT should be
// copied into the resulting access token. Defaults to true for backwards compatibility.
GrantTypeJWTBearerCopyAssertionAudience *bool
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like how we need to have this be a pointer just to handle the default unset behavior. I'm thinking of just flipping the name of this param. However, I also wouldn't like inverting the logic of the flag because then you are dealing with a double negative 🤔

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// GrantTypeJWTBearerCopyAssertionAudience indicates whether the audience from the assertion JWT should be
// copied into the resulting access token. Defaults to true for backwards compatibility.
GrantTypeJWTBearerCopyAssertionAudience *bool
// GrantTypeJWTBearerOmitAssertionAudience indicates whether the audience from the assertion JWT should be
// copied into the resulting access token. Defaults to false for backwards compatibility.
GrantTypeJWTBearerOmitAssertionAudience bool

Copilot AI and others added 2 commits April 10, 2026 18:42
…plain bool GrantTypeJWTBearerOmitAssertionAudience

Agent-Logs-Url: https://github.com/datarobot-forks/hydra/sessions/b002d7b7-a0e5-4e55-b97d-4ab7d3450d04

Co-authored-by: elatt <2617872+elatt@users.noreply.github.com>
Copilot AI and others added 2 commits April 10, 2026 20:34
…g-logic

refactor: replace *bool GrantTypeJWTBearerCopyAssertionAudience with plain bool GrantTypeJWTBearerOmitAssertionAudience
@CLAassistant
Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ elatt
❌ Copilot
You have signed the CLA already but the status is still pending? Let us recheck it.

@elatt elatt marked this pull request as ready for review April 10, 2026 20:37
@elatt elatt requested review from a team and aeneasr as code owners April 10, 2026 20:37
@elatt elatt changed the title Add configuration for copying assertion audience in JWT bearer grant type Add configuration to skip copying assertion audience in JWT bearer grant type Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants