Add OIDC client secret support to policy server

Allow the policy server to accept an OIDC client secret via CLI flag
(--oidc-client-secret) or config file (policy.oidc.client_secret).
The secret is included in the bootstrap response so clients can use it
for authentication with confidential OIDC clients.

Author: brianm

cmd/epithet/policy.go

@@ -22,8 +22,9 @@ import (
 // PolicyOIDCConfig holds OIDC configuration for the policy server.
 // This is embedded in PolicyServerCLI to enable nested config paths like policy.oidc.issuer
 type PolicyOIDCConfig struct {
-	Issuer   string `help:"OIDC issuer URL" name:"issuer"`
-	ClientID string `help:"OIDC client ID" name:"client-id"`
+	Issuer       string `help:"OIDC issuer URL" name:"issuer"`
+	ClientID     string `help:"OIDC client ID" name:"client-id"`
+	ClientSecret string `help:"OIDC client secret (for confidential clients)" name:"client-secret"`
 }
 
 // PolicyServerCLI defines the CLI flags for the policy server.
@@ -171,6 +172,9 @@ func (c *PolicyServerCLI) applyOverrides(cfg *policyserver.PolicyRulesConfig) {
 	if c.OIDC.ClientID != "" {
 		cfg.OIDC.ClientID = c.OIDC.ClientID
 	}
+	if c.OIDC.ClientSecret != "" {
+		cfg.OIDC.ClientSecret = c.OIDC.ClientSecret
+	}
 	if c.DefaultExpiration != "" {
 		if cfg.Defaults == nil {
 			cfg.Defaults = &policyserver.DefaultPolicy{}

pkg/broker/auth.go

@@ -148,14 +148,18 @@ func AuthConfigToCommand(auth caclient.BootstrapAuth) (string, error) {
 			return "", fmt.Errorf("failed to get executable path: %w", err)
 		}
 
-		// Build command: <executable> auth oidc --issuer X --client-id Y --scopes A,B,C
+		// Build command: <executable> auth oidc --issuer X --client-id Y [--client-secret Z] --scopes A,B,C
 		parts := []string{
 			executable,
 			"auth", "oidc",
 			"--issuer", auth.Issuer,
 			"--client-id", auth.ClientID,
 		}
 
+		if auth.ClientSecret != "" {
+			parts = append(parts, "--client-secret", auth.ClientSecret)
+		}
+
 		if len(auth.Scopes) > 0 {
 			parts = append(parts, "--scopes", strings.Join(auth.Scopes, ","))
 		}

pkg/broker/auth_test.go

@@ -417,6 +417,28 @@ func TestAuthConfigToCommand_OIDC_NoScopes(t *testing.T) {
 	require.NotContains(t, cmd, "--scopes")
 }
 
+func TestAuthConfigToCommand_OIDC_WithClientSecret(t *testing.T) {
+	t.Parallel()
+
+	auth := caclient.BootstrapAuth{
+		Type:         "oidc",
+		Issuer:       "https://example.com",
+		ClientID:     "test-client",
+		ClientSecret: "super-secret",
+		Scopes:       []string{"openid"},
+	}
+
+	cmd, err := AuthConfigToCommand(auth)
+	require.NoError(t, err)
+
+	// Command should contain --client-secret when present
+	require.Contains(t, cmd, "auth oidc")
+	require.Contains(t, cmd, "--issuer https://example.com")
+	require.Contains(t, cmd, "--client-id test-client")
+	require.Contains(t, cmd, "--client-secret super-secret")
+	require.Contains(t, cmd, "--scopes openid")
+}
+
 func TestAuthConfigToCommand_Command(t *testing.T) {
 	t.Parallel()
 

pkg/caclient/caclient.go

@@ -97,9 +97,10 @@ type BootstrapAuth struct {
 	Type string `json:"type"`
 
 	// OIDC fields (when type="oidc")
-	Issuer   string   `json:"issuer,omitempty"`
-	ClientID string   `json:"client_id,omitempty"`
-	Scopes   []string `json:"scopes,omitempty"`
+	Issuer       string   `json:"issuer,omitempty"`
+	ClientID     string   `json:"client_id,omitempty"`
+	ClientSecret string   `json:"client_secret,omitempty"`
+	Scopes       []string `json:"scopes,omitempty"`
 
 	// Command field (when type="command") - opaque string
 	Command string `json:"command,omitempty"`

pkg/policyserver/policy_config.go

@@ -21,9 +21,10 @@ type PolicyRulesConfig struct {
 
 // OIDCConfig represents OIDC configuration for token validation
 type OIDCConfig struct {
-	Issuer   string   `yaml:"issuer" json:"issuer"`
-	ClientID string   `yaml:"client_id" json:"client_id"`
-	Scopes   []string `yaml:"scopes,omitempty" json:"scopes,omitempty"` // Optional, defaults to ["openid", "profile", "email"]
+	Issuer       string   `yaml:"issuer" json:"issuer"`
+	ClientID     string   `yaml:"client_id" json:"client_id"`
+	ClientSecret string   `yaml:"client_secret,omitempty" json:"client_secret,omitempty"` // Optional, for confidential clients
+	Scopes       []string `yaml:"scopes,omitempty" json:"scopes,omitempty"`               // Optional, defaults to ["openid", "profile", "email"]
 }
 
 // DefaultScopes returns the default OIDC scopes
@@ -38,9 +39,10 @@ type BootstrapAuth struct {
 	Type string `json:"type"`
 
 	// OIDC fields (when type="oidc")
-	Issuer   string   `json:"issuer,omitempty"`
-	ClientID string   `json:"client_id,omitempty"`
-	Scopes   []string `json:"scopes,omitempty"`
+	Issuer       string   `json:"issuer,omitempty"`
+	ClientID     string   `json:"client_id,omitempty"`
+	ClientSecret string   `json:"client_secret,omitempty"`
+	Scopes       []string `json:"scopes,omitempty"`
 
 	// Command field (when type="command") - opaque string
 	Command string `json:"command,omitempty"`
@@ -167,10 +169,11 @@ func (c *PolicyRulesConfig) BootstrapAuth() BootstrapAuth {
 	}
 
 	return BootstrapAuth{
-		Type:     "oidc",
-		Issuer:   c.OIDC.Issuer,
-		ClientID: c.OIDC.ClientID,
-		Scopes:   scopes,
+		Type:         "oidc",
+		Issuer:       c.OIDC.Issuer,
+		ClientID:     c.OIDC.ClientID,
+		ClientSecret: c.OIDC.ClientSecret,
+		Scopes:       scopes,
 	}
 }