phoenix-oss/llama-stack-mirror
0
0
Fork 1
mirror of https://github.com/meta-llama/llama-stack.git synced 2025-12-12 12:06:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: add support for TLS communication

Browse source 
Pass TLS certs to the PyJWKClient

Signed-off-by: Sébastien Han <seb@redhat.com>
This commit is contained in:
Sébastien Han 2025-10-10 12:03:53 +02:00
parent 7fa2bae3e2
commit f379c787ad
No known key found for this signature in database
3 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
llama_stack/core/server/auth_providers.py
View file

@ -109,25 +109,31 @@ class OAuth2TokenAuthProvider(AuthProvider):
"""Validate a token using the JWT token.""" """Validate a token using the JWT token."""
if self.config.jwks is None: if self.config.jwks is None:
raise ValueError("JWKS is not configured") raise ValueError("JWKS is not configured")
try: try:
# Initialize PyJWKClient if not already done
if self._jwks_client is None: if self._jwks_client is None:
ssl_context = None
if self.config.tls_cafile:
ssl_context = ssl.create_default_context(cafile=self.config.tls_cafile.as_posix())
self._jwks_client = jwt.PyJWKClient( self._jwks_client = jwt.PyJWKClient(
self.config.jwks.uri, self.config.jwks.uri,
cache_keys=True, cache_keys=True,
max_cached_keys=10, max_cached_keys=10,
lifespan=3600, # 1 hour cache lifespan=self.config.jwks.key_recheck_period, # Use configurable period
ssl_context=ssl_context,
) )
# Get the signing key from the JWT token # Get the signing key from the JWT token
signing_key = self._jwks_client.get_signing_key_from_jwt(token) signing_key = self._jwks_client.get_signing_key_from_jwt(token)
# Get the algorithm from the JWT token
algorithm = jwt.get_unverified_header(token)["alg"]
# Decode and verify the JWT # Decode and verify the JWT
claims = jwt.decode( claims = jwt.decode(
token, token,
signing_key.key, signing_key.key,
algorithms=["RS256", "HS256", "ES256"], # Common algorithms algorithms=[algorithm],
audience=self.config.audience, audience=self.config.audience,
issuer=self.config.issuer, issuer=self.config.issuer,
options={"verify_exp": True, "verify_aud": True, "verify_iss": True}, options={"verify_exp": True, "verify_aud": True, "verify_iss": True},

2
pyproject.toml
View file

@ -34,7 +34,7 @@ dependencies = [
"openai>=1.107", # for expires_after support "openai>=1.107", # for expires_after support
"prompt-toolkit", "prompt-toolkit",
"python-dotenv", "python-dotenv",
"PyJWT>=2.8.0", "pyjwt[crypto]>=2.8.0", # Pull crypto to support RS256 for jwt.
"pydantic>=2.11.9", "pydantic>=2.11.9",
"rich", "rich",
"starlette", "starlette",

9
uv.lock generated
View file

@ -1775,7 +1775,7 @@ dependencies = [
{ name = "pillow" }, { name = "pillow" },
{ name = "prompt-toolkit" }, { name = "prompt-toolkit" },
{ name = "pydantic" }, { name = "pydantic" },
{ name = "pyjwt" }, { name = "pyjwt", extra = ["crypto"] },
{ name = "python-dotenv" }, { name = "python-dotenv" },
{ name = "python-multipart" }, { name = "python-multipart" },
{ name = "rich" }, { name = "rich" },
@ -1898,7 +1898,7 @@ requires-dist = [
{ name = "pillow" }, { name = "pillow" },
{ name = "prompt-toolkit" }, { name = "prompt-toolkit" },
{ name = "pydantic", specifier = ">=2.11.9" }, { name = "pydantic", specifier = ">=2.11.9" },
{ name = "pyjwt", specifier = ">=2.8.0" }, { name = "pyjwt", extras = ["crypto"], specifier = ">=2.8.0" },
{ name = "python-dotenv" }, { name = "python-dotenv" },
{ name = "python-multipart", specifier = ">=0.0.20" }, { name = "python-multipart", specifier = ">=0.0.20" },
{ name = "rich" }, { name = "rich" },
@ -3555,6 +3555,11 @@ wheels = [
{ url = "https://files.pythonhosted.org/packages/61/ad/689f02752eeec26aed679477e80e632ef1b682313be70793d798c1d5fc8f/PyJWT-2.10.1-py3-none-any.whl", hash = "sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb", size = 22997, upload-time = "2024-11-28T03:43:27.893Z" }, { url = "https://files.pythonhosted.org/packages/61/ad/689f02752eeec26aed679477e80e632ef1b682313be70793d798c1d5fc8f/PyJWT-2.10.1-py3-none-any.whl", hash = "sha256:dcdd193e30abefd5debf142f9adfcdd2b58004e644f25406ffaebd50bd98dacb", size = 22997, upload-time = "2024-11-28T03:43:27.893Z" },
] ]
[package.optional-dependencies]
crypto = [
{ name = "cryptography" },
]
[[package]] [[package]]
name = "pymilvus" name = "pymilvus"
version = "2.6.1" version = "2.6.1"