statecraft.
Catalog/rahi

021-idp-proxy-and-discovery

rauthy behind a same-origin proxy: the raw /auth/* route, discovery, JWKS, client bootstrap

Lifecycle approvedImplementation completeVerification unknownQualification unknown

One public origin for app and IdP: rauthy binds loopback, the app reverse-proxies the /auth/* subtree to it raw and unfiltered with bodies streamed, the issuer and every OIDC endpoint live under the app's URL, the driver trusts rauthy's discovery document fetched through the loopback base and caches its JWKS with rotation, and the app's OIDC client is bootstrapped on first boot with authorization-code plus refresh, S256 PKCE, RS256, and redirect URIs derived from the public URL. rauthy is a release binary in the same container and is never forked. Carries enrahitu://005.

Read the full pinned specification ↗

Relationships

depends on

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/Cargo.toml"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/lib.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/config.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/proxy.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/discovery.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/jwks.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/bootstrap.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/proxy.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/discovery.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/common/mod.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/testdata/discovery/"
}
  • extends
    {
  "nature": "additive",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "anchor": "workspace.dependencies",
    "file": "Cargo.toml",
    "kind": "section"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "022-session-and-principal",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/tests/session.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "022-session-and-principal",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/tests/oidc/"
  }
}

Source headings

  1. 021: rauthy behind a same-origin proxy
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. 8. Status
  10. Verification

Frozen anchors

No frozen anchors declared.