Full Changelog: v1.7.0...v3.32.0-muir1

Full Changelog: v2.8.3-muir.1...v3.27.0-muir.1

Adds a "typ":"JWT" header to created tokens

Full Changelog: v1.7.0...v2.5.0-muir.1

Full Changelog: v1.7.0...v2.3.0-muir.1

Full Changelog: v1.7.0...v2.1.2-muir.1

2.0.0 (2023-03-24)

Bug Fixes

• allow http schema for redirect url for native apps in dev mode (#242) (a314c14)
• allow RFC3339 encoded time strings (711a194), closes #292
• correct returned field for JWTTokenRequest (a08ce50), closes #283
• exchange cors library and add X-Requested-With to Access-Control-Request-Headers (#260) (b031c1f)
• glob support for RedirectURIs (7e57985), closes #293
• handle the zero cases for oidc.Time (115813e)
• nil pointer dereference on UserInfoAddress (#207) (fa222c5), closes #203 #203
• unmarshalling of scopes in access token (#320) (eea2ed1), closes #318
• unmarshalling of scopes in access token (#327) (c6820ba), closes #318
• use the same schema encoder everywhere (#299) (4dca29f), closes #295
• WithPath on NewCookieHandler set domain instead! (#240) (89d1c90)

chore

• remove unused context in NewOpenIDProvider (4bd2b74)

Code Refactoring

• use struct types for claim related types (#283) (dea8bc9)

Features

• add CanRefreshTokenInfo to support non-JWT refresh tokens (#244) (cdf2af6)
• add missing IntrospectionResponse getters (#251) (87a545e)
• add rp.RevokeToken (#231) (39852f6)
• allow id token hint verifier to specify algs (#229) (1aa75ec)
• GetUserinfo helper method for IDTokenClaims (#337) (890a7f3)
• op: dynamic issuer depending on request / host (#278) (1165d88), closes #261
• support EndSession with RelyingParty client (#230) (bd47b5d)
• Token Exchange (RFC 8693) (#255) (8e29879)

BREAKING CHANGES

• The following types are changed from interface to struct type:

• AccessTokenClaims
• IDTokenClaims
• IntrospectionResponse
• UserInfo and related types.

The following methods of OPStorage now take a pointer to a struct type,
instead of an interface:

• SetUserinfoFromScopes
• SetUserinfoFromToken
• SetIntrospectionFromToken

The following functions are now generic, so that type-safe extension
of Claims is now possible:

• op.VerifyIDTokenHint

• op.VerifyAccessToken

• rp.VerifyTokens

• rp.VerifyIDToken

• Changed UserInfoAddress to pointer in UserInfo and
  IntrospectionResponse.
  This was needed to make omitempty work correctly.

• Copy or merge maps in IntrospectionResponse and SetUserInfo

• op: add example for VerifyAccessToken

• fix: rp: wrong assignment in WithIssuedAtMaxAge

WithIssuedAtMaxAge assigned its value to v.maxAge, which was wrong.
This change fixes that by assiging the duration to v.maxAgeIAT.

• rp: add VerifyTokens example

• oidc: add standard references to:

• IDTokenClaims
• IntrospectionResponse
• UserInfo

• only count coverage for ./pkg/...
• • op.NewOpenIDProvider

• op.NewDynamicOpenIDProvider

The call chain of above functions did not use the context anywhere.
This change removes the context from those fucntion arguments.

• op: The OpenID Provider package is now able to handle multiple issuers with a single storage implementation. The issuer will be selected from the host of the request and passed into the context, where every function can read it from if necessary. This results in some fundamental changes:

• Configuration interface:
  • Issuer() string has been changed to IssuerFromRequest(r *http.Request) string
  • Insecure() bool has been added
• OpenIDProvider interface and dependants:
  • Issuer has been removed from Config struct
  • NewOpenIDProvider now takes an additional parameter issuer and returns a pointer to the public/default implementation and not an OpenIDProvider interface:
    NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opOpts ...Option) (OpenIDProvider, error) changed to NewOpenIDProvider(ctx context.Context, issuer string, config *Config, storage Storage, opOpts ...Option) (*Provider, error)
  • therefore the parameter type Option changed to the public type as well: Option func(o *Provider) error
  • AuthCallbackURL(o OpenIDProvider) func(string) string has been changed to AuthCallbackURL(o OpenIDProvider) func(context.Context, string) string
  • IDTokenHintVerifier() IDTokenHintVerifier (Authorizer, OpenIDProvider, SessionEnder interfaces), AccessTokenVerifier() AccessTokenVerifier (Introspector, OpenIDProvider, Revoker, UserinfoProvider interfaces) and JWTProfileVerifier() JWTProfileVerifier (IntrospectorJWTProfile, JWTAuthorizationGrantExchanger, OpenIDProvider, RevokerJWTProfile interfaces) now take a context.Context parameter IDTokenHintVerifier(context.Context) IDTokenHintVerifier, AccessTokenVerifier(context.Context) AccessTokenVerifier and JWTProfileVerifier(context.Context) JWTProfileVerifier
  • OidcDevMode (CAOS_OIDC_DEV) environment variable check has been removed, use WithAllowInsecure() Option
• Signing: the signer is not kept in memory anymore, but created on request from the loaded key:
  • Signer interface and func NewSigner have been removed
  • ReadySigner(s Signer) ProbesFn has been removed
  • CreateDiscoveryConfig(c Configuration, s Signer) *oidc.DiscoveryConfiguration has been changed to CreateDiscoveryConfig(r *http.Request, config Configuration, storage DiscoverStorage) *oidc.DiscoveryConfiguration
  • Storage interface:
    • GetSigningKey(context.Context, chan<- jose.SigningKey) has been changed to SigningKey(context.Context) (SigningKey, error)
    • KeySet(context.Context) ([]Key, error) has been added
    • GetKeySet(context.Context) (*jose.JSONWebKeySet, error) has been changed to KeySet(context.Context) ([]Key, error)
  • SigAlgorithms(s Signer) []string has been changed to SigAlgorithms(ctx context.Context, storage DiscoverStorage) []string
  • KeyProvider interface: GetKeySet(context.Context) (*jose.JSONWebKeySet, error) has been changed to KeySet(context.Context) ([]Key, error)
  • CreateIDToken: the Signer parameter has been removed

• move example

• fix examples

• fix mocks

• update readme

• fix examples and update usage

• update go module version to v2

• build branch

• fix(module): rename caos to zitadel

• fix: add state in access token response (implicit flow)

• fix: encode auth response correctly (when using query in redirect uri)

• fix query param handling

• feat: add all optional claims of the introspection response

• fix: use default redirect uri when not passed

Full Changelog: v1.7.0...v1.13.2-muir.1

Full Changelog: v1.7.0...v1.13.0-muir.1

Full Changelog: v1.7.0...v1.9.0-muir.7