Skip to content

Commit b6a9f58

Browse files
jfallowsclaude
jfallows
and
claude
authored
feat(guard-identity): add identity guard for unvalidated bearer pass-through (#1794)
* feat(guard-identity): add identity guard for unvalidated bearer pass-through Adds a guard that captures the inbound credentials string verbatim and returns it via GuardHandler.credentials(sessionId). Useful when Zilla is chaining a bearer to an upstream that performs its own validation (e.g. proxying GitHub PATs to github-mcp-server, sidecars trusting an upstream IdP, internal gateways behind a verified perimeter). The guard takes no options. Schema rejects any options block. Sessions are shared per (context, identity) and ref-counted; null credentials produce fresh non-shared sessions. - runtime/guard-identity: IdentityGuard, IdentityGuardContext, IdentityGuardHandler, IdentityGuardFactorySpi, plus unit tests (factory, handler) and an integration test driven by engine spec network/application scripts - specs/guard-identity.spec: identity.schema.patch.json adds the "identity" guard type with options: false, additionalProperties: false; SchemaTest validates a minimal positive config * feat(guard-identity): bundle in the Zilla Docker image Adds guard-identity to cloud/docker-image/pom.xml and zpm.json.template so the SPI registration is included in ghcr.io/aklivity/zilla images alongside guard-jwt. Without these entries, type: identity would not resolve in deployments using the official image. --------- Co-authored-by: Claude <noreply@anthropic.com>
1 parent e88ebe9 commit b6a9f58

31 files changed

Lines changed: 2495 additions & 0 deletions

File tree

‎cloud/docker-image/pom.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,12 @@
271271
<version>${project.version}</version>
272272
<scope>runtime</scope>
273273
</dependency>
274+
<dependency>
275+
<groupId>${project.groupId}</groupId>
276+
<artifactId>guard-identity</artifactId>
277+
<version>${project.version}</version>
278+
<scope>runtime</scope>
279+
</dependency>
274280
<dependency>
275281
<groupId>${project.groupId}</groupId>
276282
<artifactId>guard-jwt</artifactId>

‎cloud/docker-image/src/main/docker/zpm.json.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
"io.aklivity.zilla:exporter-prometheus",
5858
"io.aklivity.zilla:exporter-stdout",
5959
"io.aklivity.zilla:filesystem-http",
60+
"io.aklivity.zilla:guard-identity",
6061
"io.aklivity.zilla:guard-jwt",
6162
"io.aklivity.zilla:metrics-stream",
6263
"io.aklivity.zilla:metrics-http",

‎runtime/guard-identity/COPYRIGHT‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Copyright ${copyrightYears} Aklivity Inc
2+
3+
Licensed under the Aklivity Community License (the "License"); you may not use
4+
this file except in compliance with the License. You may obtain a copy of the
5+
License at
6+
7+
https://www.aklivity.io/aklivity-community-license/
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11+
WARRANTIES OF ANY KIND, either express or implied. See the License for the
12+
specific language governing permissions and limitations under the License.

‎runtime/guard-identity/LICENSE‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
Aklivity Community License Agreement
2+
Version 1.0
3+
4+
This Aklivity Community License Agreement Version 1.0 (the “Agreement”) sets
5+
forth the terms on which Aklivity, Inc. (“Aklivity”) makes available certain
6+
software made available by Aklivity under this Agreement (the “Software”). BY
7+
INSTALLING, DOWNLOADING, ACCESSING, USING OR DISTRIBUTING ANY OF THE SOFTWARE,
8+
YOU AGREE TO THE TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO
9+
SUCH TERMS AND CONDITIONS, YOU MUST NOT USE THE SOFTWARE. IF YOU ARE RECEIVING
10+
THE SOFTWARE ON BEHALF OF A LEGAL ENTITY, YOU REPRESENT AND WARRANT THAT YOU
11+
HAVE THE ACTUAL AUTHORITY TO AGREE TO THE TERMS AND CONDITIONS OF THIS
12+
AGREEMENT ON BEHALF OF SUCH ENTITY. “Licensee” means you, an individual, or
13+
the entity on whose behalf you are receiving the Software.
14+
15+
1. LICENSE GRANT AND CONDITIONS.
16+
17+
1.1 License. Subject to the terms and conditions of this Agreement,
18+
Aklivity hereby grants to Licensee a non-exclusive, royalty-free,
19+
worldwide, non-transferable, non-sublicenseable license during the term
20+
of this Agreement to: (a) use the Software; (b) prepare modifications and
21+
derivative works of the Software; (c) distribute the Software (including
22+
without limitation in source code or object code form); and (d) reproduce
23+
copies of the Software (the “License”). Licensee is not granted the
24+
right to, and Licensee shall not, exercise the License for an Excluded
25+
Purpose. For purposes of this Agreement, “Excluded Purpose” means making
26+
available any software-as-a-service, platform-as-a-service,
27+
infrastructure-as-a-service or other similar online service that competes
28+
with Aklivity products or services that provide the Software.
29+
30+
1.2 Conditions. In consideration of the License, Licensee’s distribution
31+
of the Software is subject to the following conditions:
32+
33+
(a) Licensee must cause any Software modified by Licensee to carry
34+
prominent notices stating that Licensee modified the Software.
35+
36+
(b) On each Software copy, Licensee shall reproduce and not remove or
37+
alter all Aklivity or third party copyright or other proprietary
38+
notices contained in the Software, and Licensee must provide the
39+
notice below with each copy.
40+
41+
“This software is made available by Aklivity, Inc., under the
42+
terms of the Aklivity Community License Agreement, Version 1.0
43+
located at http://www.Aklivity.io/Aklivity-community-license. BY
44+
INSTALLING, DOWNLOADING, ACCESSING, USING OR DISTRIBUTING ANY OF
45+
THE SOFTWARE, YOU AGREE TO THE TERMS OF SUCH LICENSE AGREEMENT.”
46+
47+
1.3 Licensee Modifications. Licensee may add its own copyright notices
48+
to modifications made by Licensee and may provide additional or different
49+
license terms and conditions for use, reproduction, or distribution of
50+
Licensee’s modifications. While redistributing the Software or
51+
modifications thereof, Licensee may choose to offer, for a fee or free of
52+
charge, support, warranty, indemnity, or other obligations. Licensee, and
53+
not Aklivity, will be responsible for any such obligations.
54+
55+
1.4 No Sublicensing. The License does not include the right to
56+
sublicense the Software, however, each recipient to which Licensee
57+
provides the Software may exercise the Licenses so long as such recipient
58+
agrees to the terms and conditions of this Agreement.
59+
60+
2. TERM AND TERMINATION. This Agreement will continue unless and until
61+
earlier terminated as set forth herein. If Licensee breaches any of its
62+
conditions or obligations under this Agreement, this Agreement will
63+
terminate automatically and the License will terminate automatically and
64+
permanently.
65+
66+
3. INTELLECTUAL PROPERTY. As between the parties, Aklivity will retain all
67+
right, title, and interest in the Software, and all intellectual property
68+
rights therein. Aklivity hereby reserves all rights not expressly granted
69+
to Licensee in this Agreement. Aklivity hereby reserves all rights in its
70+
trademarks and service marks, and no licenses therein are granted in this
71+
Agreement.
72+
73+
4. DISCLAIMER. Aklivity HEREBY DISCLAIMS ANY AND ALL WARRANTIES AND
74+
CONDITIONS, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND SPECIFICALLY
75+
DISCLAIMS ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
76+
PURPOSE, WITH RESPECT TO THE SOFTWARE.
77+
78+
5. LIMITATION OF LIABILITY. Aklivity WILL NOT BE LIABLE FOR ANY DAMAGES OF
79+
ANY KIND, INCLUDING BUT NOT LIMITED TO, LOST PROFITS OR ANY CONSEQUENTIAL,
80+
SPECIAL, INCIDENTAL, INDIRECT, OR DIRECT DAMAGES, HOWEVER CAUSED AND ON ANY
81+
THEORY OF LIABILITY, ARISING OUT OF THIS AGREEMENT. THE FOREGOING SHALL
82+
APPLY TO THE EXTENT PERMITTED BY APPLICABLE LAW.
83+
84+
6.GENERAL.
85+
86+
6.1 Governing Law. This Agreement will be governed by and interpreted in
87+
accordance with the laws of the state of California, without reference to
88+
its conflict of laws principles. If Licensee is located within the
89+
United States, all disputes arising out of this Agreement are subject to
90+
the exclusive jurisdiction of courts located in Santa Clara County,
91+
California. USA. If Licensee is located outside of the United States,
92+
any dispute, controversy or claim arising out of or relating to this
93+
Agreement will be referred to and finally determined by arbitration in
94+
accordance with the JAMS International Arbitration Rules. The tribunal
95+
will consist of one arbitrator. The place of arbitration will be Palo
96+
Alto, California. The language to be used in the arbitral proceedings
97+
will be English. Judgment upon the award rendered by the arbitrator may
98+
be entered in any court having jurisdiction thereof.
99+
100+
6.2 Assignment. Licensee is not authorized to assign its rights under
101+
this Agreement to any third party. Aklivity may freely assign its rights
102+
under this Agreement to any third party.
103+
104+
6.3 Other. This Agreement is the entire agreement between the parties
105+
regarding the subject matter hereof. No amendment or modification of
106+
this Agreement will be valid or binding upon the parties unless made in
107+
writing and signed by the duly authorized representatives of both
108+
parties. In the event that any provision, including without limitation
109+
any condition, of this Agreement is held to be unenforceable, this
110+
Agreement and all licenses and rights granted hereunder will immediately
111+
terminate. Waiver by Aklivity of a breach of any provision of this
112+
Agreement or the failure by Aklivity to exercise any right hereunder
113+
will not be construed as a waiver of any subsequent breach of that right
114+
or as a waiver of any other right.

‎runtime/guard-identity/NOTICE‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Licensed under the Aklivity Community License (the "License"); you may not use
2+
this file except in compliance with the License. You may obtain a copy of the
3+
License at
4+
5+
https://www.aklivity.io/aklivity-community-license/
6+
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
9+
WARRANTIES OF ANY KIND, either express or implied. See the License for the
10+
specific language governing permissions and limitations under the License.
11+
12+
This project includes:
13+

‎runtime/guard-identity/NOTICE.template‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Licensed under the Aklivity Community License (the "License"); you may not use
2+
this file except in compliance with the License. You may obtain a copy of the
3+
License at
4+
5+
https://www.aklivity.io/aklivity-community-license/
6+
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
9+
WARRANTIES OF ANY KIND, either express or implied. See the License for the
10+
specific language governing permissions and limitations under the License.
11+
12+
This project includes:
13+
#GENERATED_NOTICES#

0 commit comments

Comments
 (0)