Dynamic Authentication Plugin Operations

Dynamic authentication plugins are WebAssembly modules loaded from paths named by [auth_plugins]. Each plugin has a corresponding [auth_plugin.<name>] section containing its path, pinned SHA-256 digest, operating mode, capabilities, network allowlist, and resource limits.

Dynamic plugins require a Keystone binary built with the wasm_plugins cargo feature, which is not part of the default build because it pulls in the extism/wasmtime runtime. The published container image enables it. Without the feature [auth_plugins] is ignored and a warning is logged at startup. See Cargo features.

Before deployment:

1. Build and review the module from a trusted source.
2. Pin its SHA-256 digest.
3. Grant only the required host capabilities and outbound hosts.
4. Configure time, fuel, memory, concurrency, and invocation-rate limits.
5. Restart Keystone and verify load status without logging secrets.

When replacing a module, update valid_since so tokens issued through the old version can be rejected according to deployment policy. Use the administrative identity-link and revoke-all APIs for controlled linking and compromise response.

See Authentication plugin development for the guest contract, host functions, and testing workflow.