Auth0 OIDC (as-built)¶
Harness Open Source does not ship native Auth0 SSO. This fleet uses a forked image with OIDC env vars.
Live shape¶
| Item | Notes |
|---|---|
| Auth0 app | Regular Web App (Terraform on astra under /opt/terraform/auth0-harness-portal) |
| Callback | https://portal.alanredfordhayes.ai/api/v1/oidc/callback |
| Image | Local tag alanredfordhayes/harness:oidc-3.3.0 |
| OIDC env | /root/.secrets/harness-oidc.env (mode 600) |
| Link model | Email link to existing Harness principal (signup off) |
Verify (no secrets)¶
curl -skD - -o /dev/null https://portal.alanredfordhayes.ai/api/v1/oidc/login | head
# expect 302 Location → Auth0 /authorize with PKCE; Secure cookies for state/pkce
curl -fsS https://portal.alanredfordhayes.ai/api/v1/system/config | jq .oidc_enabled
# true
Secrets hygiene¶
- Rotate credentials in Auth0 Dashboard / on-host files — never paste values into docs or chat.
- Do not commit
terraform.tfstateor scrape it into this repo. - Residual ops HITL may exist for M2M provider creds; see private wiki assessment, not this public page.
Source wiki: ~/agent-wiki/concepts/harness-fork-auth0-oidc-asbuilt.md · culled 2026-09-16