d6d41dd84f
Fix OpenBao OIDC token exchange compatibility
Build and Publish Container Image / build-and-push (push) Has been cancelled
2026-06-01 21:20:54 +02:00
937cb39de6
Require MFA during bootstrap mode
Build and Publish Container Image / build-and-push (push) Has been cancelled
2026-05-25 00:09:40 +02:00
7e22fcf3c7
bootrapping support
Build and Publish Container Image / build-and-push (push) Has been cancelled
2026-05-24 17:03:01 +02:00
3ee8090a98
feat: implement T09, T15, T21 — userinfo endpoint, LLDAP export, negative tests
...
- T09: /userinfo with RS256 JWT validation, scope-filtered claims
- T15: LLDAP→canonical export tool with validation, migration_event telemetry
- T21: Negative test suite (Scenario D) — all 7 unsupported features verified
All go tests passing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-13 02:08:03 +01:00
4097a7de8b
feat: implement T06, T07 — authorization endpoint, token endpoint
...
- T06: /authorize with full PKCE validation, Authelia delegation, MFA check
- T07: /token with RS256 JWT issuance (stdlib only), PKCE verification, scope-filtered claims
50 OIDC tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-13 01:56:57 +01:00
b0adbc5daa
feat: implement T14, T10 — enforcement middleware, LLDAP adapter
...
- T14: Unsupported feature registry with 7 pre-registered profile boundaries
- T10: LLDAP adapter implementing UserRepository; validator-gated reads
24 tests pass, go vet clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-13 01:45:21 +01:00
22f7a7dc50
feat: implement T05, T08, T13 — OIDC discovery, JWKS, telemetry pipeline
...
- T05: /.well-known/openid-configuration — profile-only features advertised
- T08: /jwks — RS256 JWK Set, stdlib crypto only, key rotation support
- T13: Structured telemetry — Event types, LogEmitter/NoopEmitter/MultiEmitter, context helpers
38 server tests pass, go vet clean.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-13 01:35:34 +01:00
