oidc-client-example

Overview ¶

Command oidc-client-example is a worked Harbor Protocol client that obtains a JWT from an OAuth2 / OIDC provider via the client-credentials grant and attaches it to a production `harbor serve` instance. It is the runnable companion to the production-identity setup guide (docs/site/protocol/production-identity-setup.md): the guide explains the claim shape `harbor serve`'s verifier enforces; this program shows a real client walking the on-ramp end to end.

Like its sibling event-viewer, it is deliberately SDK-free — pure stdlib against the Harbor Protocol wire. The point is that the Protocol IS the integration surface: a third-party client in any language obtains a token from its identity provider and attaches with nothing but HTTP and a JWT. No Harbor Go import is required, and the phase smoke compile-gates that (an `internal/...` or `sdk/...` import creeping in would break the SDK-free guarantee the guide promises).

What it does, in order:

1. Runs the OAuth2 client-credentials grant against your identity provider's token endpoint (client_secret_basic authentication, the spec-recommended default) and receives a signed JWT access token.
2. Decodes the token's own `scopes` claim — without verifying it; the RUNTIME verifies, the client merely reports what it was granted — so the operator can see which entitlements the IdP issued.
3. Calls `runtime.info` against `harbor serve` with the token in the `Authorization: Bearer` header. A 200 proves the runtime's JWKS verifier accepted the IdP-signed token: the production identity path is live. The runtime's build identity, Protocol version, and advertised capabilities are printed, and the Protocol major version is checked for compatibility.

The (tenant, user, session) isolation triple travels INSIDE the JWT claims (mapped from your IdP per the setup guide), so no separate identity header is needed: the verified claims become the request's identity at the Protocol edge.

Usage:

export OIDC_TOKEN_URL=https://your-idp.example.com/oauth/token
export OIDC_CLIENT_ID=harbor-client
export OIDC_CLIENT_SECRET=...           # keep this out of your shell history
export OIDC_SCOPE='console:fleet'        # optional, space-separated
export HARBOR_BASE_URL=https://harbor.example.com   # your `harbor serve`
go run ./examples/protocol-clients/oidc-client-example