ablative docs

Go to

↑↓ move↵ openesc close
 Stack Notebook ablative.com.au

Auth and Lys

Choose Lys passes or JWT validation and protect each transport with the correct grants.

Open .md

Choose the trust mode

With authentication disabled, the server grants operator authority. The subject header supplies the audit label in this mode. Keep this mode local.

With Lys configured, bearer tokens are Lys passes. The server reads the issuer’s published keys and resolves the pass’s rights. Lys resolves namespace rights from the pass.

[auth]
enabled = true

[auth.lys]
issuer = "https://identity.example.test"
connector_credential_file = "/run/aion/lys-connector-credential"
drafts_pull_seconds = 5

The issuer must be the deployment’s actual Lys origin. Provision the connector credential file and choose positive draft-pull seconds. Setting any supported Lys environment variable creates the section with its other fields empty. Supply all three values and enable authentication; an incomplete section refuses boot. Keep credential values in the file.

Lys
On main, crates/aion-server/src/config/env.rs:197–211 maps the Lys variables to nested auth.lys fields. Any one of those variables creates the section with otherwise empty values at lines 471–479. load_auth.rs:29–51 requires auth.enabled=true, a nonempty issuer, a connector credential file and positive draft-pull seconds.
HTTP endpoint precedence
On main, crates/aion-cli/src/tail.rs:26 and cli_args.rs:525 bind AION_HTTP_ENDPOINT. Each command’s explicit --http-endpoint wins. client_dispatch.rs:192 passes the signal value to its dry-run contract read.

JWT mode

Without Lys, JWT validation requires a binary built with the auth feature, a JWKS URL and an explicit namespace claim. Reserved typed claims cannot be repurposed as the namespace claim. Remove that setting if authentication is disabled.

On main, a build without the auth feature refuses auth-enabled JWT mode at boot. Lys pass validation is included independently. The boot guard is crates/aion-server/src/run.rs:536–544; Lys validation is crates/aion-server/src/config/load_auth.rs:21–51.

Grants

Namespace access permits operations only within those namespaces. Deploy authority covers source saves, deployments, routing and operator package operations. Assistant-session authority opens the caller’s own conversations, scoped by authenticated subject.

The identity endpoint reports the server’s grant vocabulary and the caller’s resolved grants. Check it instead of inventing a token claim or header spelling.

Workers

A gRPC worker on a Lys deployment uses a worker-scoped pass. The CLI worker paths can obtain and refresh it from the served credential options.

The liminal listener’s shared connection token proves connection admission, not individual worker identity. On an authenticated server it needs both the token-file path and one admitted namespace. A registration for another namespace is refused.

Browsers and MCP

CORS origins for the public API and allowed origins for MCP are separate settings. Neither grants authorization. Public MCP also needs its own enable setting.

See all access fields and worker options.

Install JWT support

The default CLI build omits JWT verification. Install the auth-enabled command before configuring this mode.

auth
Optional Cargo feature. Add --features auth to cargo install or cargo build for JWT verification. Default aion-cli features omit it.
Implementation
crates/aion-cli/Cargo.toml:143–149 forwards auth to aion-server/auth. Server validation is in crates/aion-server/src/config/load_auth.rs.
Namespace claim
Name a provider claim containing one non-empty namespace string. Choose a custom claim outside the reserved typed claims. JWT namespace extraction is in crates/aion-server/src/auth/jwks.rs:128–139.
Registry updater
The update installer invokes cargo install without --features auth. Preserve JWT support by installing the selected release explicitly with that feature before the planned server handover.

Merge these fields into the config generated by your installed release. Replace the example issuer and claim with your identity provider’s values.

[auth]
enabled = true
jwks_url = "https://identity.example.test/.well-known/jwks.json"
namespace_claim = "namespaces"
jwks_refresh_seconds = 300

Load a valid bearer into the named process setting, then inspect the resolved grants. Keep credential values out of command history.

curl --fail-with-body -sS -X GET "${AION_HTTP_ENDPOINT:-http://127.0.0.1:8080}/whoami" \
  -H "authorization: Bearer $AION_TOKEN"

For closed namespace creation, follow namespace setup.