mirror of
https://github.com/openai/codex.git
synced 2026-11-13 21:30:47 +00:00
cooper-oai
6242064da0
## What changed Allow Unix workloads to acquire assertions directly from the SPIFFE Workload API for the existing OpenAI token exchange. Select this source with `OPENAI_IDENTITY_TOKEN_SOURCE=spiffe`, alongside `OPENAI_FEDERATION_RULE_ID`, `SPIFFE_ENDPOINT_SOCKET`, and `OPENAI_SPIFFE_AUDIENCE`. Optionally select an identity with `OPENAI_SPIFFE_ID`. Fetch a JWT-SVID over a Unix socket for each exchange, reconnecting on refresh and bounding acquisition to ten seconds. Reject ambiguous responses and mismatched subject or audience claims, and retain only the gRPC status code from agent errors. Signature and lifetime verification remain the token endpoint's responsibility. Keep file acquisition as the default, reject conflicting source settings, and exclude the new OpenAI-specific settings from model-launched environments. Document configuration and deployment constraints. ## Testing Add local-socket tests for token exchange and refresh after agent restart, concurrent refreshes, JWT-SVIDs without key IDs, identity selection, error redaction, and timeouts. Add configuration tests for explicit source selection, invalid or conflicting settings, unsupported platforms, and session consistency. GitOrigin-RevId: 9d88438ff41cd8f0b7356c512ec451455ed7c399
40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
# Workload identity assertions
|
|
|
|
This crate exchanges an assertion for a short-lived OpenAI access token. The
|
|
exchange caches the access token in memory and reacquires an assertion when it
|
|
needs to refresh. The login crate selects and pins the source from the process
|
|
environment.
|
|
|
|
File acquisition remains the default: set `OPENAI_FEDERATION_RULE_ID` and an
|
|
absolute `OPENAI_IDENTITY_TOKEN_FILE`. The file is reopened for every exchange.
|
|
|
|
For SPIFFE Workload API acquisition on Unix, configure the credential-owning
|
|
Codex process with:
|
|
|
|
```sh
|
|
export OPENAI_FEDERATION_RULE_ID="<federation-rule-id>"
|
|
export OPENAI_IDENTITY_TOKEN_SOURCE="spiffe"
|
|
export SPIFFE_ENDPOINT_SOCKET="unix:///run/spire/agent.sock"
|
|
export OPENAI_SPIFFE_AUDIENCE="<audience-accepted-by-the-federation-rule>"
|
|
export OPENAI_SPIFFE_ID="spiffe://example.org/workload"
|
|
```
|
|
|
|
`OPENAI_SPIFFE_ID` is optional if the agent returns exactly one JWT-SVID.
|
|
`OPENAI_IDENTITY_TOKEN_FILE` must be unset in SPIFFE mode. An ambient
|
|
`SPIFFE_ENDPOINT_SOCKET` alone does not select workload identity authentication.
|
|
TCP endpoints are not supported. Remote app-server deployments need the socket
|
|
on the host that owns authentication.
|
|
|
|
Codex calls the standard `FetchJWTSVID` RPC with the SPIFFE security metadata.
|
|
It keeps the JWT-SVID in memory for the exchange and reconnects on subsequent
|
|
acquisitions. Connection and request time are bounded together to ten seconds.
|
|
The token endpoint remains responsible for signature and lifetime verification.
|
|
An agent may reuse a JWT-SVID; deployments enabling assertion replay protection
|
|
must configure their issuer accordingly.
|
|
|
|
The agent's workload-attestation policy controls which processes can acquire
|
|
the identity. This feature does not add socket permissions to sandboxed tools
|
|
or make bearer tokens bound to a host. OpenAI-specific WIF settings are removed
|
|
from model-launched environments; the standard SPIFFE endpoint variable retains
|
|
its existing behavior for other workloads.
|