openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-07 20:30:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Support workload identity in remote exec-server auth (#38610)

Browse Source 
## Why

Remote exec-server registry requests need to refresh managed credentials before sending a request. Static auth-header resolution cannot perform the asynchronous token exchange required by workload identity.

## What changed

- Add asynchronous auth-header resolution to `AuthProvider`, with the existing static-header behavior as the default.
- Resolve fresh managed credentials for each remote environment registry request while preserving the expected account and workspace identity.
- Load the cloud configuration bundle during remote exec-server startup when workload identity is selected.

## Testing

- Update the managed-auth and environment-registry auth tests to exercise asynchronous header resolution.

GitOrigin-RevId: 5d60f1127467aaacdb5d1a8f3d92278bc4bf2e29
This commit is contained in:
cooper-oai
2026-08-14 17:32:37 +00:00
committed by copyberry
parent c0d59bf614
commit fb5aa093e0
6 changed files with 163 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/codex-api/src/lib.rs
+1
View File
@@ -22,6 +22,7 @@ pub use crate::api_bridge::map_api_error;
pub use crate::auth::AgentIdentityTelemetry;
pub use crate::auth::AuthError;
pub use crate::auth::AuthHeaderTelemetry;
pub use crate::auth::AuthHeadersFuture;
pub use crate::auth::AuthProvider;
pub use crate::auth::AuthProviderFuture;
pub use crate::auth::SharedAuthProvider;