tokens
module wittgenstein_oidc_backend.tokens
Keycloak token decoding — two modes, mirroring AgentGateway's own
policies.jwtAuth.mode toggle (see wittgenstein-deployment's
roles/agentgateway/templates/config.yaml.j2):
"validate": full RS256 signature verification against the realm's JWKS, plus issuer/audience checks. Use this when the token reaches the service directly (no gateway already validated it)."trust": decode the payload without verifying the signature. Use this only when an AgentGateway (or equivalent) upstream has already validated the token and the service trusts that boundary — this avoids a redundant JWKS round-trip on every request. Never default to this silently; callers must opt in explicitly.
Classes
-
TokenError — Raised for any token decode/verification failure — callers should treat this uniformly (401/403), never let the underlying jwt/httpx exception leak into a response.
Functions
-
decode_token — Decode a Keycloak-issued JWT and return its claims payload.
wittgenstein_oidc_backend.tokens.TokenError
class TokenError()
Bases : Exception
Raised for any token decode/verification failure — callers should treat this uniformly (401/403), never let the underlying jwt/httpx exception leak into a response.
wittgenstein_oidc_backend.tokens.decode_token
async decode_token(token: str, *, mode: OidcMode, jwks_client: JwksClient | None = None, issuer: str | None = None, audience: str | None = None) → dict[str, Any]
Decode a Keycloak-issued JWT and return its claims payload.
mode="validate" requires jwks_client and issuer.
mode="trust" needs neither — it only decodes.
Raises