Found during
omnibioai-api-gateway PR #3 (IAM Foundation gateway integration, merged 2026-08-04).
Problem
app/core/jwt.py (create_access_token, create_service_access_token) issues no aud/iss claims on any token today. Consuming services that want to validate audience/issuer per standard JWT practice have nothing to check against.
Impact
omnibioai-api-gateway added IAM_AUDIENCE/IAM_ISSUER config (per its integration spec) but cannot enforce either -- there's no claim on any real token to validate, and omnibioai-iam-client's decode_token() doesn't check for them even when present. The config exists ahead of this support landing in both places; currently a no-op.
Suggested scope
omnibioai-auth: add iss (e.g. the auth service's own identifier) and aud (target service(s)/gateway) claims to issued tokens -- likely needs an audience-per-consumer or a single shared-gateway-audience model, whichever fits the deployment topology.omnibioai-iam-client: extend decode_token() to optionally validate aud/iss against caller-supplied expected values, only enforced once (1) ships so this doesn't reject every pre-existing token during rollout.
Cross-reference: omnibioai-iam-client#3 and #4 are the other two IAM-stack follow-ups this same gateway integration PR surfaced.
Found during
omnibioai-api-gatewayPR #3 (IAM Foundation gateway integration, merged 2026-08-04).Problem
app/core/jwt.py(create_access_token,create_service_access_token) issues noaud/issclaims on any token today. Consuming services that want to validate audience/issuer per standard JWT practice have nothing to check against.Impact
omnibioai-api-gatewayaddedIAM_AUDIENCE/IAM_ISSUERconfig (per its integration spec) but cannot enforce either -- there's no claim on any real token to validate, andomnibioai-iam-client'sdecode_token()doesn't check for them even when present. The config exists ahead of this support landing in both places; currently a no-op.Suggested scope
omnibioai-auth: addiss(e.g. the auth service's own identifier) andaud(target service(s)/gateway) claims to issued tokens -- likely needs an audience-per-consumer or a single shared-gateway-audience model, whichever fits the deployment topology.omnibioai-iam-client: extenddecode_token()to optionally validateaud/issagainst caller-supplied expected values, only enforced once (1) ships so this doesn't reject every pre-existing token during rollout.Cross-reference:
omnibioai-iam-client#3and#4are the other two IAM-stack follow-ups this same gateway integration PR surfaced.