KNELProductionContainers/OIDC_AUTHENTICATION_AUDIT.md

OIDC Authentication Audit for KNEL Cloudron Packages

CRITICAL REQUIREMENT: OIDC Authentication Support

All production Cloudron packages MUST support OIDC (OpenID Connect) authentication for mission-critical, revenue-generating workloads.

Current Package Status

✅ FULL OIDC SUPPORT

1. Jenkins CI/CD Platform

• Status: ✅ FULL OIDC SUPPORT
• Method: OpenID Connect Authentication Plugin
• Configuration: Via Jenkins plugin system
• Documentation: https://plugins.jenkins.io/openid-connect-authentication/
• Cloudron Integration: Configured via environment variables

2. Apache APISIX API Gateway

• Status: ✅ FULL OIDC SUPPORT
• Method: Built-in OpenID Connect Plugin
• Configuration: Via APISIX admin API
• Documentation: https://apisix.apache.org/docs/apisix/plugins/openid-connect/
• Cloudron Integration: Configured via admin API

3. Rundeck Job Scheduler

• Status: ✅ FULL OIDC SUPPORT (Commercial Version)
• Method: OAuth2 Resource Server with JWT validation
• Configuration: Via rundeck-config.properties
• Documentation: https://docs.rundeck.com/docs/administration/security/sso/
• Cloudron Integration: Configured via environment variables
• Note: Requires Rundeck Pro/Enterprise for full OIDC support

⚠️ LIMITED AUTHENTICATION SUPPORT

4. Rathole Reverse Proxy

• Status: ❌ NO OIDC SUPPORT
• Authentication: None (tunnel proxy)
• Security Model: Network-level security via tokens
• Recommendation: Use behind authenticated reverse proxy
• Documentation: Document as network-level security only

Implementation Requirements

For Each Package with OIDC Support:

1. Environment Variables Required:

   CLOUDRON_OIDC_ISSUER_URL=https://your-oidc-provider.com
   CLOUDRON_OIDC_CLIENT_ID=your-client-id
   CLOUDRON_OIDC_CLIENT_SECRET=your-client-secret
   CLOUDRON_OIDC_REDIRECT_URI=https://your-app.cloudron.me/oidc/callback
   

2. Configuration Files:

   • Jenkins: jenkins_home/org.jenkinsci.plugins.openid_connect.OpenIdConnectSecurityRealm.xml
   • APISIX: Route configuration with OIDC plugin
   • Rundeck: rundeck-config.properties with OAuth settings

3. Health Check Endpoints:

   • Must verify OIDC configuration on startup
   • Must test OIDC provider connectivity
   • Must validate JWT token processing

Production Readiness Checklist

• OIDC provider configuration tested
• JWT token validation working
• User session management configured
• Logout functionality working
• Error handling for OIDC failures
• Fallback authentication method (if applicable)
• Security headers configured
• CORS settings for OIDC callbacks

Documentation Requirements

Each package must include:

1. OIDC configuration instructions
2. Required environment variables
3. Troubleshooting guide
4. Security considerations
5. Fallback authentication methods (if any)

Next Steps

1. Immediate: Configure OIDC for Jenkins, APISIX, and Rundeck
2. Document: Rathole's network-level security model
3. Test: All OIDC configurations in staging environment
4. Validate: Production-ready OIDC integration

---

CRITICAL: No package will be considered production-ready without proper OIDC authentication support and comprehensive testing.