Support OIDC (Humans) and SPIFFE (Machines) Authorization Options

[mksinghtx]

As we support Tunnel connections from clients that are both Human accessed (Datum Desktop) and Machine accessed (server, sidecar, agent etc) we need to ensure a robust, yet easy to use, authorization experience.

For Human experiences use Datum's existing OAuth 2.0 / OIDC support:

• Focus: User/Application Authentication (Who are you?).
• Mechanism: Uses tokens (JWTs) issued by an Authorization Server after a user logs in, verifying identity.
• Use Case: Single Sign-On (SSO), web/mobile app login, linking user identity to application access.
• Nature: Often platform-bound or relies on pre-configured roles/secrets.

For Machine experiences, support SPIFFE (Secure Production Identity Framework for Everyone):

• Focus: Workload Identity & Interoperability (What are you?).
• Mechanism: Issues Verifiable Identity Documents (SVIDs - JWTs or X.509 certs) to workloads, attested from their runtime environment (e.g., Kubernetes pod, VM metadata).
• Use Case: Zero Trust, mTLS between services, securing microservices, cross-cloud communication.
• Nature: Portable, attestation-based, works across different environments (cloud, on-prem) without static secrets.

Outstanding Questions

• What do we need to implement to support SPIFFE? Can the SPIRE reference implementation help us re-use existing OIDC infrastructure?
• After a machine is authorized, how does it renew and how often?
• What is the Identity and how is it allocated or retrieved?
• For mTLS and tunnels - if raw keys will be used then how are we distributing those?
• Dynamic Client Registration implementation

[zsmithnyc]

Existing planned enhancement for Machine Accounts and Machine Key Management here.