Skip to content

fix: skip token exchange when no credentials configured (OSS Conductor auth)#148

Closed
manan164 wants to merge 1 commit into
conductor-oss:mainfrom
manan164:fix/oss-auth-404
Closed

fix: skip token exchange when no credentials configured (OSS Conductor auth)#148
manan164 wants to merge 1 commit into
conductor-oss:mainfrom
manan164:fix/oss-auth-404

Conversation

@manan164
Copy link
Copy Markdown
Collaborator

@manan164 manan164 commented May 5, 2026

Problem

When OrkesAuthenticationSettings is not configured (null KeyId/KeySecret), accessing Configuration.AccessToken calls TokenHandler.GetToken() which unconditionally proceeds to POST /api/token. On OSS Conductor this endpoint returns 404/405, causing an unhandled exception and preventing the SDK from being used against unauthenticated OSS deployments at all.

Fix

Added early-return guards in both GetToken() and RefreshToken() in TokenHandler.cs: if authenticationSettings is null or either KeyId/KeySecret is null or empty, return null immediately without attempting the token exchange.

This is safe because:

  • If auth is not configured, the caller should not expect a token.
  • The existing Configuration.AccessToken property already returns null when AuthenticationSettings is null, so downstream code already handles null tokens.
  • Authenticated (Orkes Cloud) deployments are unaffected — they always provide non-empty credentials.

Changes

Conductor/Client/Authentication/TokenHandler.cs

  • GetToken(): return null early when credentials are absent
  • RefreshToken(): return null early when credentials are absent

Testing

To reproduce the bug before this fix: create a Configuration with no AuthenticationSettings, call any API method, observe the 404/405 exception from TokenHandler. After this fix the call proceeds without a token (appropriate for OSS Conductor).

When no KeyId/KeySecret are provided in OrkesAuthenticationSettings,
calling GetToken() would proceed to POST /api/token which returns
404/405 on OSS Conductor, causing an unhandled exception.

Fix: return null early in both GetToken() and RefreshToken() when
credentials are null or empty, so unauthenticated OSS deployments
work without throwing.
@codecov
Copy link
Copy Markdown

codecov Bot commented May 5, 2026

Codecov Report

❌ Patch coverage is 0% with 10 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
Conductor/Client/Authentication/TokenHandler.cs 0.00% 10 Missing ⚠️
Flag Coverage Δ
unittests 1.05% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
Conductor/Client/Authentication/TokenHandler.cs 12.72% <0.00%> (-2.83%) ⬇️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@manan164
Copy link
Copy Markdown
Collaborator Author

manan164 commented May 6, 2026

Closing — the Agentspan SDK sets AuthenticationSettings = null for OSS Conductor, which is already handled correctly in 1.1.4. This fix would only apply if someone passes OrkesAuthenticationSettings with empty credentials, which is not our use case.

@manan164 manan164 closed this May 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant