feat(dcm): forward OIDC tokens and support auth-disabled deployments (FLPATH-4480)

workspaces/dcm/README.md

@@ -30,3 +30,22 @@ This runs the full app and backend concurrently (frontend at http://localhost:30
 - **yarn start:dev** – Run both plugins in standalone mode (no full app/backend).
 
 Configuration is in `app-config.yaml`. Example catalog data is in `examples/`.
+
+## Authentication
+
+Set `dcm.auth.enabled` to match the DCM control plane's `auth.enabled` setting.
+
+- When enabled, the DCM UI uses the signed-in user's OIDC access token. Configure
+  an OIDC provider in RHDH `auth.providers`, including its metadata URL, client
+  ID, and client secret. The proxy requires normal RHDH/Backstage credentials
+  and the user token, then forwards that token to DCM as an upstream Bearer
+  token.
+- When disabled, the UI does not require an OIDC provider or send an upstream
+  Bearer token. The proxy still requires normal RHDH/Backstage credentials, so
+  the standalone and guest-only configurations use the guest session. DCM then
+  applies its auth-disabled system actor rather than a per-user identity.
+
+The standalone local configuration uses DCM auth-disabled mode. The proxy never
+uses its shared `client_credentials` token for normal UI requests. Do not
+configure or expose OIDC access tokens as static application configuration
+values.

workspaces/dcm/app-config.production.yaml

@@ -11,9 +11,16 @@ backend:
     connection: ':memory:'
 
 dcm:
+  # Keep this aligned with the DCM control plane's auth.enabled setting.
+  auth:
+    enabled: ${DCM_AUTH_ENABLED:-false}
+  # Base URL of the DCM control plane.
   apiUrl: ${DCM_API_URL:-}
   # Legacy env var; kept until deploy configs switch to DCM_API_URL.
   apiGatewayUrl: ${DCM_API_GATEWAY_URL:-}
+  # These settings are used only by the separately permission-protected token
+  # endpoint. Normal DCM UI proxy requests forward the signed-in user's OIDC
+  # token and do not use this shared client-credentials flow.
   ssoBaseUrl: ${DCM_SSO_BASE_URL:-}
   clientId: ${DCM_CLIENT_ID:-}
   clientSecret: ${DCM_CLIENT_SECRET:-}

workspaces/dcm/app-config.yaml

@@ -41,7 +41,15 @@ techdocs:
 
 auth:
   providers:
+    # Local development only. Replace this with the OIDC provider below for
+    # a deployed environment.
     guest: {}
+    # oidc:
+    #   production:
+    #     metadataUrl: https://keycloak.example.com/realms/rhdh/.well-known/openid-configuration
+    #     clientId: rhdh-auth
+    #     clientSecret: ${AUTH_OIDC_CLIENT_SECRET}
+    #     prompt: auto
 
 permission:
   enabled: true
@@ -61,6 +69,9 @@ permission:
 scaffolder: {}
 
 dcm:
+  # The standalone app uses the DCM control plane's auth-disabled mode.
+  auth:
+    enabled: false
   policyPacks:
     - security-baseline
     - compliance-pci
@@ -70,10 +81,10 @@ dcm:
   # Override in app-config.local.yaml for local development.
   # apiUrl: https://your-control-plane.example.com
   #
-  # SSO credentials for the backend to obtain a bearer token:
-  # ssoBaseUrl: https://sso.redhat.com
-  # clientId: your-client-id
-  # clientSecret: your-client-secret
+  # Set auth.enabled to true only when the DCM control plane's auth.enabled is
+  # also true. In that mode, configure an OIDC provider under auth.providers.
+  # The normal RHDH Authorization header authenticates the request to this
+  # backend, while the user's OIDC token is forwarded to DCM by the proxy.
 
 catalog:
   import:

workspaces/dcm/plugins/dcm-backend/app-config.dynamic.yaml

@@ -1,10 +1,13 @@
 dcm:
+  # Keep this aligned with the DCM control plane's auth.enabled setting.
+  auth:
+    enabled: ${DCM_AUTH_ENABLED:-true}
   # Base URL of the DCM control plane (required).
   apiUrl: ${DCM_API_URL}
   # Legacy env var; kept until deploy configs switch to DCM_API_URL.
   apiGatewayUrl: ${DCM_API_GATEWAY_URL}
 
-  # SSO configuration for the backend to obtain bearer tokens via
+  # SSO configuration for the separately permission-protected token endpoint.
   ssoBaseUrl: ${DCM_SSO_BASE_URL}
   clientId: ${DCM_CLIENT_ID}
   clientSecret: ${DCM_CLIENT_SECRET}

workspaces/dcm/plugins/dcm-backend/config.d.ts

@@ -39,6 +39,17 @@ export interface Config {
      */
     apiGatewayUrl?: string;
 
+    /**
+     * Whether the DCM control plane requires per-user OIDC authentication.
+     *
+     * Must match the control plane's `auth.enabled` setting.
+     *
+     * @visibility backend
+     */
+    auth?: {
+      enabled?: boolean;
+    };
+
     /**
      * Base URL for the SSO token endpoint.
      *