APIGOV-32516 - Create IdentityProvider and IdentityProviderMetadata resources from agent IdP config#1029
Open
APIGOV-32516 - Create IdentityProvider and IdentityProviderMetadata resources from agent IdP config#1029
Conversation
sbolosan
requested review from
alrosca,
dfeldick,
dgghinea,
jcollins-axway and
vivekschauhan
as code owners
jcollins-axway
previously approved these changes
May 1, 2026
sbolosan
commented
May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New feature flag agentFeatures.manageIDPResources (default: false). When enabled, the SDK creates and maintains IdentityProvider and IdentityProviderMetadata resources in Engage during IdP provider registration.
IdP lifecycle logic queries Engage before creating to avoid duplicates. On creation, environment credential policies (expiry/visibility) are applied to the new resource and IdentityProviderMetadata is populated from live IdP server metadata.
Optional IDPResourceSupplier extension point allows agent implementations to supply custom IdentityProvider or IdentityProviderMetadata resource shapes instead of the SDK defaults.
The CredentialRequestDefinition registered at startup is linked to the IdentityProvider resource name created or found during IdP registration.
External credential short-circuit: when a credential's provision mode is external, the SDK skips RegisterClient during both provisioning and rotate — the client was registered outside the SDK and should not be touched. New constant CredProvisionModeExternal introduced.
GetProvisionMode() added to the CredentialRequest interface and its mock to expose the provision mode to provisioning handlers.
SetIDPResourceName / GetIDPResourceName added to both the provider registry and IdP registry interfaces and implementations, storing the Engage resource name keyed by metadata URL for later lookup.
Api-server models regenerated from branch APIGOV-32071: new IdentityProviderMetadata resource, IdentityProvider policies subresource, Credential.spec.provision.mode field, and updated IdentityProvider spec shape.