{{ message }}
Repository navigation
[CP-768] feat(auth): add login with endpoint-inferred Auth0 issuer - #219
Open
qdrant-cloud-bot wants to merge 11 commits into
Open
qdrant-cloud-bot wants to merge 11 commits into
qdrant-cloud-bot wants to merge 11 commits into
Conversation
Discover the login URL from QDRANT_CLOUD_ENDPOINT (grpc.<cluster> → login.<cluster>), preferring unauthenticated API gateway protected-resource metadata when OAuth is enabled.
Robert-Stam
reviewed
Oct 10, 2026
Present browser login and API keys as alternatives, drop Auth0 and non-prod hosts from generated help.
qdrant-cloud-bot
changed the title
1 of 2 tasks
* [CP-768] fix(auth): send audience on device-code login Auth0 does not apply the resource parameter on /oauth/device/code, so that request must use audience. The poll stays a plain device-code grant, backs off on slow_down, and the loopback callback checks iss when Auth0 sends it. * test(auth): keep require out of http handlers in device login test golangci-lint (testifylint go-require, wsl_v5) flagged the device-login test. A form parse error now returns 400 from the handler, which still fails the login. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Robert-Stam <robert.stam@qdrant.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Auth0 matches a loopback callback's port exactly, so a random port fails with Callback URL mismatch. Try 48271, 48272 and 48273 in order; each is registered on the CLI's Auth0 application. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Each Auth0 tenant generates its own client id for the native app, and a native app's id is public, so ship them keyed by issuer: users no longer pass --client-id. Development is set; staging and production are TBD until their apps exist, and ask for --client-id meanwhile. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A self-contained page (inline Qdrant mark and terminal icon, no fonts, scripts or other requests, light and dark) for success and failure, instead of plain text. The failure detail is HTML-escaped; strict CSP. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ogin Same grid background, wordmark above a white card, title and tiles as the Auth0 Universal Login pages. Still self-contained: the grid image and logos are inline, the system font replaces the web font. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… was not used On development, discover fell back to endpoint inference while curl got the metadata; the reason was swallowed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ail_verified iam-service's ExchangeToken requires email_verified in the Auth0 access token. The custom-token-claims Action sets it, but Auth0 silently drops it: email_verified is a reserved OpenID Connect claim name. With the email scope Auth0 adds it itself, as for the Cloud console. Found on development: invalid_grant: email not verified in JWT payload. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
qcloud auth discover|login|logout|status|token.QDRANT_CLOUD_ENDPOINT/--endpoint(grpc.<cluster>.qdrant.io→login.<cluster>.qdrant.io).https://api.<cluster>.qdrant.io/.well-known/oauth-protected-resourcewhen OAuth is enabled; fall back to hostname inference when it is not.--device. The loopback listener uses the first free port of 48271, 48272 and 48273: Auth0 matches a loopback callback's port exactly (a random port gets "Callback URL mismatch"), so the threehttp://127.0.0.1:<port>/callbackURLs are registered on the CLI's Auth0 application. tokens incredentials.yaml(0600). API keys still win when set. gRPC sendsAuthorization: Bearerafter login.grpc.development-cloud.qdrant.io:443https://login.development-cloud.qdrant.io/grpc.staging-cloud.qdrant.io:443https://login.staging-cloud.qdrant.io/grpc.cloud.qdrant.io:443https://login.cloud.qdrant.io/The "Qdrant Cloud CLI" client id is built in per login URL (
internal/oauth/clientid.go): each Auth0 tenant generates its own, and a native app's id is public. Development is set; staging and production areTBDuntil their apps exist, and ask for--client-id/QDRANT_CLOUD_OAUTH_CLIENT_IDmeanwhile.qcloud auth discoverneeds no client id.Test plan
qcloud auth discover --endpoint grpc.development-cloud.qdrant.io:443(inference when PRM is down)golangci-lint+go teston affected packagesqcloud auth login --endpoint grpc.development-cloud.qdrant.io:443(no--client-id)protected-resource metadata