Keep built-in OIDC identity types upgrade-safe

.github/workflows/codeql-verification.yml

@@ -31,7 +31,11 @@ jobs:
           test -z "$(git status --porcelain)"
           git merge-base --is-ancestor origin/main HEAD
           test "$(git rev-list --count origin/main..HEAD)" -eq 1
-          grep -Fxq '    <version>0.183.300</version>' code/meta-parent/pom.xml
+          project_version="$(sed -n 's/^[[:space:]]*<version>\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1)"
+          build_version="$(sed -n 's/^ENGINE_VERSION=${ENGINE_VERSION:-\([^}]*\)}$/\1/p' scripts/build)"
+          [[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          test "$build_version" = "$project_version"
+          test -f "docs/releases/orchestration-engine-${project_version}.md"
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

COMPATIBILITY.md

@@ -6,7 +6,7 @@ New operator-facing names use PastureStack and `PASTURESTACK_*`. Compatibility i
 
 ## Docker host policy
 
-Release `0.183.309` preserves the Docker host policy introduced in `0.183.299`,
+Release `0.183.310` preserves the Docker host policy introduced in `0.183.299`,
 which adds Docker Engine `29.8.0` as an exact supported
 version alongside the preserved legacy ranges, `24.0.9`, and the existing
 `29.4.1` through `29.7.2` interval. It does not widen the interval to admit
@@ -23,6 +23,15 @@ modifying another backend. Each of those modes needs runtime acceptance on
 the relevant host before a Server release that consumes this Engine is
 published as fully supported.
 
+## External identity type upgrades
+
+`oidc_user` and `oidc_group` are built-in OpenID Connect identity types. An
+older database setting may replace the packaged external-type list and omit
+them, so release `0.183.310` always unions these two reviewed types into API
+schema options and Engine validation. Other configured provider types remain
+dynamic, unknown identity types remain rejected, and the external provider
+must still be configured before any external identity can be transformed.
+
 ## Browser token session ownership
 
 Web Console `1.6.117` and newer supplies a high-entropy client session
@@ -71,8 +80,9 @@ cover both the dynamic overlay and the deserialized frozen snapshots.
 The reviewed external identity list includes `oidc_user` and `oidc_group` in
 addition to the established GitHub, Shibboleth, and LDAP types. The same
 dynamic setting drives project-member schema options and Engine validation;
-environment overrides may replace the list for compatible deployments, but an
-active external provider does not authorize arbitrary identity type strings.
+environment overrides may extend or narrow provider-specific compatibility
+types, but cannot remove the two built-in OIDC types. An active external
+provider still does not authorize arbitrary identity type strings.
 The reviewed default list must be present in a `META-INF/cattle` defaults file
 that production Archaius startup actually loads; the installer-facing root
 `cattle-global.properties` alone is not a Java runtime configuration source.

README.md

@@ -9,8 +9,8 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 ## Project status
 
 The current public GitHub Release
-[`v0.183.309`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.309)
-produces engine version `0.183.309`. It retains the existing Java 25, Ubuntu
+[`v0.183.310`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.310)
+produces engine version `0.183.310`. It retains the existing Java 25, Ubuntu
 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and
 runtime-hardening work from the maintained compatibility line. Release builds
 consume the exact `5.7.4` runtime JAR published by
@@ -21,6 +21,14 @@ product identity and provenance are carried by the artifact name, metadata,
 SBOM, and release evidence. Provenance and scope are documented in
 [`third-party/HAZELCAST.md`](third-party/HAZELCAST.md).
 
+Release `0.183.310` makes the two built-in OpenID Connect identity types
+upgrade-safe. An older database can override the packaged external-type list
+without `oidc_user` or `oidc_group`; token creation and project membership then
+fail after the provider has already authenticated the user. Engine validation
+and both API schema generations now union those two reviewed built-in types
+with the dynamic list. Unknown types are still rejected, and no external
+identity is accepted unless the external provider is configured.
+
 Release `0.183.309` preserves the authenticated PastureStack operator
 credential when an administrator posts `/v1-auth/config`. Earlier releases
 replaced that credential with the external identity provider's access token;
@@ -119,7 +127,7 @@ dependency line. The existing platform JSON surface remains on
 `com.fasterxml.jackson` 2.22. Packaging gates admit only the reviewed,
 version-pinned pair and verify that their class namespaces are disjoint.
 
-Host compatibility is evidence-based. Release `0.183.309` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate.
+Host compatibility is evidence-based. Release `0.183.310` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate.
 
 The build and Dapper images still compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; the CLI tool version is separate from the Docker daemon host support setting. They do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release.
 
@@ -167,7 +175,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK
 To create the complete release archive after the gate passes:
 
 ```sh
-ENGINE_VERSION=0.183.309 bash scripts/build --release
+ENGINE_VERSION=0.183.310 bash scripts/build --release
 bash scripts/check-release-artifact dist/artifacts/cattle.jar
 ```
 

code/framework/api-pub-sub-jetty/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api-pub-sub/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/archaius/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
 </project>

code/framework/async/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/auditing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
 

code/framework/db-loader/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/deferred/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/encryption/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/engine/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/eventing/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/events/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension-spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/extension/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/java-server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jmx/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/jooq/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/json/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/launcher/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>io.cattle</groupId>
 		<artifactId>cattle-parent</artifactId>
-		<version>0.183.309</version>
+		<version>0.183.310</version>
     <relativePath>../../parent/pom.xml</relativePath>
 	</parent>
 	<dependencies>

code/framework/lock/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/logback/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-meta-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/managed-context/pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>io.cattle</groupId>
     <artifactId>cattle-parent</artifactId>
-    <version>0.183.309</version>
+    <version>0.183.310</version>
     <relativePath>../../parent/pom.xml</relativePath>
   </parent>
   <dependencies>

code/framework/metrics/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/module/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/object/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/pool/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/resource-monitor/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/schema/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/schema/src/main/java/io/cattle/platform/schema/processor/AuthSchemaAdditionsPostProcessor.java

@@ -11,12 +11,14 @@
 import io.github.ibuildthecloud.gdapi.model.impl.SchemaImpl;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.LinkedHashSet;
 import java.util.List;
 
 public class AuthSchemaAdditionsPostProcessor extends AbstractSchemaPostProcessor implements SchemaPostProcessor, Priority {
 
     private static final ConfigListProperty<String> AUTH_SERVICE_EXTERNAL_ID_TYPES = ArchaiusUtil.getStringListProperty("auth.service.external.id.types");
+    private static final List<String> REQUIRED_OIDC_IDENTITY_TYPES = Arrays.asList("oidc_user", "oidc_group");
 
     @Override
     public SchemaImpl postProcess(SchemaImpl schema, SchemaFactory factory) {
@@ -31,6 +33,11 @@ public SchemaImpl postProcess(SchemaImpl schema, SchemaFactory factory) {
                 if (configured != null) {
                     options.addAll(configured);
                 }
+                // A database setting created by an older release can override
+                // the packaged Archaius default. OIDC is a built-in provider,
+                // so its reviewed identity types must remain available after
+                // an in-place upgrade even when that stale override exists.
+                options.addAll(REQUIRED_OIDC_IDENTITY_TYPES);
                 field.setOptions(new ArrayList<String>(options));
             }
         }

code/framework/schema/src/test/java/io/cattle/platform/schema/processor/AuthSchemaAdditionsPostProcessorTest.java

@@ -49,7 +49,7 @@ public void externalIdTypesReadDynamicListThroughWrapper() {
 
             new AuthSchemaAdditionsPostProcessor().postProcess(schema, null);
 
-            assertEquals(Arrays.asList("rancher_id", "ldap", "github"), field.getOptions());
+            assertEquals(Arrays.asList("rancher_id", "ldap", "github", "oidc_user", "oidc_group"), field.getOptions());
         } finally {
             if (ConfigurationManager.getConfigInstance().containsKey(key)) {
                 ConfigurationManager.getConfigInstance().clearProperty(key);

code/framework/server/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>cattle-meta-parent</artifactId>
         <groupId>io.cattle</groupId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../meta-parent/pom.xml</relativePath>
     </parent>
     <dependencies>

code/framework/spring/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.cattle</groupId>
         <artifactId>cattle-parent</artifactId>
-        <version>0.183.309</version>
+        <version>0.183.310</version>
         <relativePath>../../parent/pom.xml</relativePath>
     </parent>
     <dependencies>