nova_auth_oidc_sup (nova_auth_oidc v0.2.0)

View Source

Supervisor for OIDC provider configuration workers. Each provider gets its own oidcc_provider_configuration_worker child that fetches and caches the provider's discovery document and JWKS.

Summary

Types

extra_worker_opts()

Functions

start_provider(Name, Issuer)

Start a provider configuration worker as a child of this supervisor.

start_provider(Name, Issuer, ExtraOpts)

Start a provider configuration worker, threading extra oidcc_provider_configuration_worker options alongside the required issuer/name - most notably provider_configuration_opts => #{request_opts => #{ssl => [...]}} to pin the discovery/JWKS fetch to an explicit CA bundle instead of the OS trust store. See nova_auth_oidc's moduledoc for why this key must be treated as a trust anchor, not just a TLS knob.

Types

extra_worker_opts()

-type extra_worker_opts() ::
          #{provider_configuration_opts => oidcc_provider_configuration:opts(),
            backoff_min => oidcc_backoff:min(),
            backoff_max => oidcc_backoff:max(),
            backoff_type => oidcc_backoff:type()}.

Functions

start_provider(Name, Issuer)

-spec start_provider(atom(), binary()) -> supervisor:startchild_ret().

Start a provider configuration worker as a child of this supervisor.

start_provider(Name, Issuer, ExtraOpts)

-spec start_provider(atom(), binary(), extra_worker_opts()) -> supervisor:startchild_ret().

Start a provider configuration worker, threading extra oidcc_provider_configuration_worker options alongside the required issuer/name - most notably provider_configuration_opts => #{request_opts => #{ssl => [...]}} to pin the discovery/JWKS fetch to an explicit CA bundle instead of the OS trust store. See nova_auth_oidc's moduledoc for why this key must be treated as a trust anchor, not just a TLS knob.

ExtraOpts cannot override issuer or name: this supervisor owns those two identity fields, so they are applied after merging in ExtraOpts.

Prefer certfile/keyfile paths over inline key material ({key, ...}, {password, ...}) in the ssl option list: ExtraOpts is echoed verbatim in this supervisor's crash/restart SASL reports, so inline secrets end up in logs and crash dumps every time the worker restarts.