AgentCube Authentication & Authorization Enhancement Proposal

Executive Summary

This proposal outlines a comprehensive authentication and authorization enhancement for the AgentCube project, building upon the existing ServiceAccount-based authentication to support multiple authentication methods while maintaining security best practices.

Current State Analysis

Existing Authentication

  • ServiceAccount Authentication via TokenReview API
  • JWT Token Generation with RSA-2048 keys
  • Redis-based session management

Limitations

  • Single authentication method (ServiceAccount only)
  • No support for API keys or OAuth tokens
  • Limited token revocation mechanisms
  • No rate limiting on authentication endpoints

Proposed Enhancement

Multi-Method Authentication

  • JWT Authentication (RS256) with refresh tokens
  • OAuth 2.0 / OIDC integration
  • API Key Authentication with bcrypt
  • Enhanced ServiceAccount support

Enhanced Authorization

  • RBAC Engine with role definitions
  • Namespace-scoped permissions
  • Resource-level access control

Security Features

  • Rate limiting (sliding window)
  • Token revocation (Redis blacklist)
  • Comprehensive audit logging
  • Secure password hashing (bcrypt)

Implementation Plan

Phase 1: Core Infrastructure

Extend JWT manager, implement API key storage, create unified auth interface

Phase 2: OAuth Integration

OAuth 2.0 flow, token introspection, IdP integration

Phase 3: Enhanced Authorization

RBAC engine, role management, authorization middleware

Phase 4: Security Hardening

Token revocation, audit logging, security headers

Security Considerations

Authentication Security

  • • Algorithm confusion prevention
  • • Short-lived tokens
  • • Secure token storage
  • • Token revocation

Authorization Security

  • • Fail-secure defaults
  • • Namespace isolation
  • • Least privilege
  • • Audit logging

For the complete proposal document, see proposal.md