What this PR does / why we need it:

Extends OIDC authentication in Feast to support GroupBasedPolicy and NamespaceBasedPolicy for OIDC users, adds flexible client token injection, and wires up operator support for OIDC deployments.

Previously, the OIDC token parser only extracted preferred_username and resource_access roles from the JWT. GroupBasedPolicy, NamespaceBasedPolicy, and CombinedGroupNamespacePolicy could never grant access for OIDC users because the User object was always created with empty groups and namespaces.

Server Side Changes

Files: oidc_token_parser.py, oidc_service.py, utils.py

When auth.type: oidc, the Feast server now handles two types of incoming tokens:

• Keycloak JWTs (human users via UI, Swagger, or notebooks) are validated against the OIDC provider's JWKS. The parser extracts preferred_username (with upn fallback for Azure AD / Entra ID), groups claim, and resource_access.<client_id>.roles. GroupBasedPolicy uses the groups. client_id is optional; when absent, roles default to empty and groups still work.
• Kubernetes SA tokens (workbench pods) are detected via the kubernetes.io claim in an initial unverified decode. These are delegated to a lightweight TokenReview that validates the token and extracts the namespace from the SA identity. NamespaceBasedPolicy uses the namespace. No RBAC queries are performed, only tokenreviews/create is needed.

Additional server improvements:

• verify_ssl field (default true) controls TLS verification for OIDC discovery and JWKS endpoints. Set to false for self-signed certificates.
• ca_cert_path field allows specifying a custom CA certificate for the OIDC provider when verify_ssl: true.
• SSL certificate errors now produce clear, actionable log messages instead of generic "Invalid token" errors.
• PyJWKClientError is now caught (previously only InvalidTokenError was caught), preventing 500 responses when JWKS endpoints are unreachable or keys are not found.
• Malformed tokens in the intra-communication check no longer crash the parser.

Server Configuration (feature_store.yaml)

Keycloak Setup Required

The OIDC client in Keycloak must have a Groups claim mapper configured:
Client > Mappers > Add "Group Membership" mapper > claim name: groups

Without this mapper, JWTs will not contain the groups claim and GroupBasedPolicy will deny all access.

Client Side Changes

Files: oidc_authentication_client_manager.py, auth_model.py, repo_config.py

OidcAuthClientManager.get_token() now supports multiple token sources with a clear priority:

1. token field in config: static JWT, returned directly, no network calls
2. token_env_var field: reads from the named environment variable on every call (supports token refresh). If the variable is configured but missing, raises PermissionError immediately with no fallback.
3. client_secret field (with auth_discovery_url and client_id): fetches token from the IDP via client_credentials or ROPG flow
4. FEAST_OIDC_TOKEN environment variable: last resort fallback for bare {type: oidc} configs
5. Kubernetes SA token file at /var/run/secrets/kubernetes.io/serviceaccount/token: for workbench pods running inside Kubernetes

token, token_env_var, and client_secret are mutually exclusive (enforced by a Pydantic validator at config load time).

Client Configuration Examples

Zero config (workbench pods or kube-authkit users):

Picks up FEAST_OIDC_TOKEN env var if set, otherwise reads the mounted SA token.

Named environment variable (supports external token refresh):

Static token (testing / CI):

Client credentials flow (service to service):

Operator Changes

Files: featurestore_types.go, repo_config.go, tls.go, services_types.go, authz.go

The operator now generates separate server and client OIDC configs:

• Server config gets auth_discovery_url (resolved from three sources), optional client_id/client_secret from Secret, verify_ssl, and ca_cert_path.
• Client config gets only {type: oidc} with an optional token_env_var. Client pods never see server credentials.

New CRD Fields on OidcAuthz

Discovery URL Resolution Priority

1. CR issuerUrl field (derives discovery URL by appending /.well-known/openid-configuration)
2. Secret auth_discovery_url key (used verbatim)
3. OIDC_ISSUER_URL environment variable on the operator pod (for RHOAI/ODH zero config)

CA Certificate Resolution Priority

1. CRD caCertConfigMap field (user specified ConfigMap, mounted at /etc/pki/tls/oidc-ca/ca.crt)
2. Auto detected odh-trusted-ca-bundle ConfigMap with odh-ca-bundle.crt key (RHOAI/ODH clusters)
3. System CA store (default when no custom CA is configured)

RBAC

When authz: oidc is configured, the operator provisions a ClusterRole and ClusterRoleBinding granting the Feast server SA tokenreviews/create permission. This enables the SA token delegation path for workbench pods.

Operator CR Example

Upstream (with issuerUrl):

ODH (OpenDataHub) zero config (platform injects OIDC_ISSUER_URL):

Permission Examples

Which issue(s) this PR fixes:

#6088

Misc