Summary
All OIDC outbound HTTP — discovery metadata, JWKS fetch, token exchange — bypasses the global proxy, contradicting the documented invariant "every outbound HTTP call honours the global proxy (proxy.resolve)". _build_oauth (src/iceberg/auth/routes.py:52-65) registers Authlib clients with no httpx client/proxy configuration, so load_server_metadata / fetch_jwk_set / token POSTs go direct.
Failure scenario
In the egress-restricted deployment the proxy feature exists for, logins to login.microsoftonline.com / *.auth0.com / *.okta.com simply time out — SSO is unusable. Every other outbound subsystem (RSS/SIEM/MISP/AI/webhook) routes through proxy.resolve.
Notes
This was pre-existing for the single Entra client, but the change rebuilt client registration from scratch for four cloud IdPs and was the natural point to wire proxy.resolve in.
Suggested fix
Configure the Authlib/httpx client used for discovery, JWKS, and token exchange with the resolved proxy from proxy.resolve.
Found in Fable review of PR #232 → HEAD.
Summary
All OIDC outbound HTTP — discovery metadata, JWKS fetch, token exchange — bypasses the global proxy, contradicting the documented invariant "every outbound HTTP call honours the global proxy (
proxy.resolve)"._build_oauth(src/iceberg/auth/routes.py:52-65) registers Authlib clients with no httpx client/proxy configuration, soload_server_metadata/fetch_jwk_set/ token POSTs go direct.Failure scenario
In the egress-restricted deployment the proxy feature exists for, logins to
login.microsoftonline.com/*.auth0.com/*.okta.comsimply time out — SSO is unusable. Every other outbound subsystem (RSS/SIEM/MISP/AI/webhook) routes throughproxy.resolve.Notes
This was pre-existing for the single Entra client, but the change rebuilt client registration from scratch for four cloud IdPs and was the natural point to wire
proxy.resolvein.Suggested fix
Configure the Authlib/httpx client used for discovery, JWKS, and token exchange with the resolved proxy from
proxy.resolve.Found in Fable review of PR #232 → HEAD.