feat(auth): add authentik IdP reference example

.github/actions/changes/action.yaml

@@ -49,6 +49,9 @@ outputs:
   cpu-smoke:
     description: "'true' if CPU smoke image or Kubernetes smoke test inputs changed"
     value: ${{ steps.filter.outputs.deps == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.docker-scripts == 'true' || steps.filter.outputs.helm == 'true' || steps.filter.outputs.openapi == 'true' || steps.filter.outputs.python-runtime == 'true' || steps.filter.outputs.web-studio == 'true' || steps.filter.outputs.k8s-smoke == 'true' }}
+  auth-idp:
+    description: "'true' if auth-idp tests or their containerized E2E harness inputs changed"
+    value: ${{ steps.filter.outputs.auth-idp == 'true' }}
 
 runs:
   using: "composite"
@@ -110,3 +113,9 @@ runs:
             - '.github/scripts/ngc_metadata.py'
             - '.github/scripts/tests/test_ngc_metadata.py'
             - '.github/assets/ngc/**'
+          auth-idp:
+            - 'conftest.py'
+            - 'pytest.ini'
+            - 'tests/auth_idp/**'
+            - 'e2e/**'
+            - 'contrib/auth/**'

.github/workflows/ci.yaml

@@ -46,6 +46,7 @@ jobs:
       cpu-smoke: ${{ steps.changes.outputs.cpu-smoke }}
       guardrails-benchmark: ${{ steps.changes.outputs.guardrails-benchmark }}
       ngc-metadata: ${{ steps.changes.outputs.ngc-metadata }}
+      auth-idp: ${{ steps.changes.outputs.auth-idp }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/changes
@@ -124,7 +125,8 @@ jobs:
     if: >
       !cancelled() && (
         github.event_name == 'workflow_dispatch' ||
-        needs.changes.outputs.cpu-smoke == 'true'
+        needs.changes.outputs.cpu-smoke == 'true' ||
+        needs.changes.outputs.auth-idp == 'true'
       )
     runs-on: ubuntu-latest
     timeout-minutes: 90
@@ -891,6 +893,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Free disk space
         uses: ./.github/actions/free-disk-space
       - name: Download policy WASM
@@ -935,6 +939,62 @@ jobs:
             coverage.xml
             coverage.json
 
+  python-auth-idp-test:
+    name: Python auth-idp tests
+    needs: [changes, policy-wasm, build-cpu-smoke-images]
+    if: >
+      !cancelled() && (
+        github.event_name == 'workflow_dispatch' ||
+        needs.changes.outputs.cpu-smoke == 'true' ||
+        needs.changes.outputs.auth-idp == 'true'
+      ) &&
+      needs.policy-wasm.result == 'success' &&
+      needs.build-cpu-smoke-images.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Free disk space
+        uses: ./.github/actions/free-disk-space
+      - name: Download policy WASM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: policy-wasm
+          path: services/core/auth/src/nmp/core/auth/assets
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          python-version: "3.11"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Log in to GHCR
+        if: needs.build-cpu-smoke-images.outputs.publish_images == 'true'
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Run auth-idp tests
+        run: make test-auth-idp
+        env:
+          _TYPER_FORCE_DISABLE_TERMINAL: "1"
+          E2E_SERVICES_LOG_DIR: ${{ runner.temp }}/e2e-services-logs
+          IMAGE_REGISTRY: ${{ needs.build-cpu-smoke-images.outputs.image_registry }}
+          BAKE_TAG: ${{ needs.build-cpu-smoke-images.outputs.image_tag }}
+      - name: Upload test artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-auth-idp-test-results
+          retention-days: 30
+          path: |
+            ${{ runner.temp }}/e2e-services-logs/
+
   # Build wheels for all packages × python versions. Downstream jobs
   # (wheel-test, python-e2e-test) download these artifacts instead
   # of rebuilding.

Makefile

@@ -122,6 +122,10 @@ docs-watch: ## Start Fern docs dev plus a repo-level watcher for docs/** changes
 docs-check: ## Validate the Fern docs (fern check + validate-mdx + gated-link check)
 	cd docs/fern && npm run check
 
+.PHONY: test-auth-idp
+test-auth-idp: ## Run the auth-idp test suite
+	bash contrib/auth/authentik/run.sh test $(ARGS)
+
 .PHONY: docs-check-python-snippets
 docs-check-python-snippets: ## Syntax-check and type-check Python snippets in one doc (DOCS_PATH=...)
 	@if [ -z "$(strip $(DOCS_PATH))" ]; then echo "Usage: make docs-check-python-snippets DOCS_PATH=docs/customizer/tutorials/import-hf-model.mdx" >&2; exit 2; fi

conftest.py

@@ -18,6 +18,7 @@
 import pytest
 from nmp.testing.pytest_outcomes import pytest_skip as skip_test
 
+from tests.auth_idp.xdist import append_xdist_group_suffix
 from tests.discovery_exclusions import TEST_DISCOVERY_EXCLUSIONS
 
 # Set test environment variables BEFORE any imports
@@ -211,6 +212,7 @@ def pytest_collection_modifyitems(config, items):
     category_markers = {
         "unit",
         "e2e",
+        "auth_idp",
         "smoke_gpu_tasks",
         "smoke_nmp_automodel_tasks",
         "smoke_nmp_automodel_training",
@@ -247,6 +249,13 @@ def pytest_collection_modifyitems(config, items):
         if not marker_names.intersection(category_markers):
             item.add_marker(pytest.mark.unit)
 
+        if getattr(config.option, "numprocesses", None) or getattr(config, "workerinput", None) is not None:
+            group_names = set()
+            for mark in item.iter_markers("xdist_group"):
+                name = mark.args[0] if mark.args else mark.kwargs.get("name", "default")
+                group_names.add(str(name))
+            item._nodeid = append_xdist_group_suffix(item.nodeid, group_names)
+
 
 # ============================================================================
 # Pytest command-line options
@@ -295,6 +304,7 @@ def pytest_runtest_setup(item):
             skip_test("Skipping container-only test (requires NMP_BASE_URL)")
 
 
+from xdist.scheduler.loadgroup import LoadGroupScheduling  # noqa: E402
 from xdist.scheduler.loadscope import LoadScopeScheduling  # noqa: E402
 
 # Temporary workaround for https://github.com/pytest-dev/pytest-xdist/issues/1189
@@ -310,3 +320,7 @@ def _patched_reschedule(self, node):
 
 
 LoadScopeScheduling._reschedule = _patched_reschedule  # type: ignore[invalid-assignment]
+
+
+def pytest_xdist_make_scheduler(config, log):
+    return LoadGroupScheduling(config, log)

contrib/auth/README.md

@@ -0,0 +1,17 @@
+# Identity Provider References
+
+This directory contains NeMo Platform identity-provider reference bundles.
+
+Each provider bundle defines one contract for local validation and production
+adaptation:
+
+- expose OIDC discovery metadata
+- include a gateway layer that strips inbound `X-NMP-Principal-*` headers
+- define one human identity and one machine identity for shared auth testing
+- treat external machine identities as ordinary OIDC principals authorized by
+  group binding, not as internal `service:*` principals
+- document provider-specific setup in a local `README.md`
+
+Open-source providers with `mode: compose-ci` are intended for the shared auth
+matrix. Reference-only providers stay documented and manifest-driven but are
+excluded from the local Compose-backed matrix.