forked from OpenIDC/mod_auth_openidc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
1752 lines (1350 loc) · 57.7 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
05/18/2021
- make error "session corrupted: no issuer found in session" a warning only so a logout call for a
non-existing session no longer produces error messages
- bump to 2.4.9-dev
05/08/2021
- store timestamps in session in seconds to avoid string conversion problems on some (libapr-1)
platform build/run combinations, causing "maximum session duration exceeded" errors
- bump to 2.4.8.2
05/07/2021
- add OIDCClientTokenEndpointKeyPassword option to allow the use of an encrypted private key
- release 2.4.8.1
04/30/2021
- fix potential crash when Content-Type is not set in POST requests; thanks Tatsuhiko Yasumatsu of JPCERT/CC
- release 2.4.8
04/21/2021
- on OAuth 2.0 RS token scope/claim 401 error, add environment variable for usage with mod_headers,
instead of adding a header ourselves; see #572; usage, e.g;
Header always append WWW-Authenticate %{OIDC_OAUTH_BEARER_SCOPE_ERROR}e "expr=(%{REQUEST_STATUS} == 401) && (-n reqenv('OIDC_OAUTH_BEARER_SCOPE_ERROR'))"
- bump to 2.4.8-dev
04/13/2021
- add OIDCRedisCacheConnectTimeout and OIDCRedisCacheTimeout options to configure Redis timeouts
- bump to 2.4.7.2
04/12/2021
- fix memory leaks when caching fails
- bump to 2.4.7.1
04/04/2021
- improve documentation on OIDCPreservePost
- release 2.4.7
04/01/2021
- bump to 2.4.7rc1
02/16/2021
- remove session from cache before clearing it.
02/12/2021
- add maximum session lifetime (exp), inactivity timeout (timeout) and remote_user to OIDCInfoHook
- bump to 2.4.7-dev
02/08/2021
- return 400 instead of 500 when state cookie matching fails
- release 2.4.6
02/03/2021
- avoid displaying the client_secret in debug logs
01/28/2021
- avoid segmentation fault when hitting an endpoint configured with AuthType openid-connect
in an OAuth 2.0 only setup; see #529
01/23/2021
- fix semaphore cleanup on graceful restarts; see #522
01/12/2021
- fix inconsistent public/private keys loading order; closes #515
12/17/2020
- remove support for https://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state
12/10/2020
- add "base64url" option to OIDCPassClaimsAs primitive; closes #417
12/09/2020
- add Redis database selection option with OIDCRedisCacheDatabase; closes #423
- optimize Redis AUTH execution once per connection
12/07/2020
- don't set SameSite=None on cookies when on plain http
12/03/2020
- add environment variable to control libcURL CURLOPT_SSL_OPTIONS behaviors
e.g.: SetEnvIfExpr true CURLOPT_SSL_OPTIONS=CURLSSLOPT_NO_REVOKE
11/23/2020
- release 2.4.5
- make sure the module compiles with Apache 2.2 for passphrase exec:
- bump to 2.4.6-dev
11/19/2020
- ensure that "sub" is returned from the userinfo endpoint following https://openid.net/specs/openid-connect-core-1_0.html#UserInfoResponse
prevents potential ID spoofing; thanks Christian Fries of Ruhr-University Bochum
- don't printout JSON errors about NULL characters in error log; thanks Christian Fries of Ruhr-University Bochum
- restrict printout of JSON parsing errors to 4096 bytes; thanks Christian Fries of Ruhr-University Bochum
- bump to 2.4.5rc6
11/5/2020
- fix content processing for info and JWKs handler so mod_headers etc. works; closes #497
- bump to 2.4.5rc5
11/2/2020
- improve sanity checking on Redis reply
- bump to 2.4.5rc4
10/30/2020
- disable caching token introspection results by setting OIDCOAuthTokenIntrospectionInterval to -1; thanks @wadahiro
- bump to 2.4.5rc3
10/27/2020
- config check on OIDCCryptoPassphrase in OAuth 2.0 RS setup with cache encryption enabled
- bump to 2.4.5rc2
10/22/2020
- hash define expression option to OIDCUnAuthAction so it compiles for Apache 2.2; fixes 1461634
- bump to 2.4.5rc1
- add exec support to OIDCCryptoPassphrase
10/19/2020
- delete stale session cookies that aren't in the cache
- allow OIDCDiscoverURL to be a relative URL
10/08/2020
- add OIDCCABundlePath for configuring path to curl CA bundle
09/22/2020
- avoid Apache 2.4 appending 401 HTML document text to step-up authentication HTML refresh page; closes #484
- bump to 2.4.5rc0
09/21/2020
- populate AUTH_TYPE when performing authentication; thanks @spanglerco
09/19/2020
- enable authentication of sub-requests when the main request doesn't require
authentication; thanks @spanglerco
09/03/2020
- add SameSite attribute on cookie clearance / logout; thanks @v0gler
- bump to 2.4.4.1
09/01/2020
- forward port Tufin patches
- always set session cookie same site policy to Lax
- disable cookie domain check
- unset host headers for metadata URL retrieval
- bump to 2.4.4-tufin
09/01/2020
- avoid GCC 9 compiler warnings
- release 2.4.4
08/28/2020
- allow Content-Type check on backchannel logout to have postfixes (utf-8 etc)
- terminate backchannel logout with DONE instead of OK to avoid authz error 500
- bump to 2.4.4rc8
08/18/2020
- add recommended cache headers on backchannel logout response
https://openid.net/specs/openid-connect-backchannel-1_0.html#rfc.section.2.8
- bump to 2.4.4rc7
08/10/2020
- add new OIDCStateCookiePrefix primitive for the state cookie prefix
08/01/2020
- add conditional expression to OIDCUnAuthAction; see #479; thanks @raro42 and @marcstern
- bump to 2.4.4rc6
07/31/2020
- reverse order of creating HTML response and adding session cookie; thanks @deisser
- bump to 2.4.4rc5
07/30/2020
- fix doubled Set-Cookie behaviour when using `client-cookie`, calling the session info hook
and writing out a session update (twice); thanks @deisser
- bump to 2.4.4rc4
07/27/2020
- prevent XSS and open redirect on OIDC session managemement OP iframe with OIDCRedirectURLsAllowed
thanks Andrew Brady
- bump to 2.4.4rc3
07/22/2020
- delete state cookie when it cannot be decoded/decrypted
- bump to 2.4.4rc2
07/03/2020
- fix for loop initial declarations to not require c99 for compilation (RHEL 6)
- add ap_expr.h include in stub.c (RHEL 6)
- bump to 2.4.4rc1
06/30/2020
- add grant_types to dynamic client registration request
- don't send access_token in user info request when method is set to POST; conform OIDC test suite 4.0.5
- bump to 2.4.4rc0
06/10/2020
- prevent open redirect on refresh token requests
add new OIDCRedirectURLsAllowed primitive to handle post logout and refresh-return-to validation
addresses #453; closes #466
- release 2.4.3
06/09/2020
- fix complex expressions crash when compiled from source with libjq; closes #472
thanks vincentscharf0803
introduced by OIDCStateInputHeaders addition in 2.4.3rc0
- bump to 2.4.3rc1
05/11/2020
- added OIDCValidateIssuer to allow for disabling of issuer matching. helps to support multi-tenant applications.
05/02/2020
- when stripping cookies, add a space between cookies in the resulting header (required by RFC 6265)
- move oidc_parse_config inside MODULE_MAGIC_NUMBER_MAJOR to make sure the module compiles with Apache 2.0
04/25/2020
- add OIDCStateInputHeaders that allows configuring the header values used to calculate the fingerprint of the state during authentication
- bump to 2.4.3rc0
03/25/2020
- oops: fix json_deep_copy of claims
- release 2.4.2.1
03/24/2020
- fix memory leak in OAuth 2.0 JWT validation; closes #470; thanks Conrad Thukral
- fix configured private/public key cleanup on process exit
03/21/2020
- allow for expressions in Require statements, see #469; thanks @wwaaron
also see: https://github.com/zmartzone/mod_auth_openidc/wiki/Authorization#expressions-in-require-statements
- bump to 2.4.2rc5
03/19/2020
- always refresh keys from jwks_uri when there is no kid in the JWT header
- bump to 2.4.2rc4
03/15/2020
- destroy shared memory segments only in parent process; see #458
- bump to 2.4.2rc3
03/10/2020
- fix memory leaks introduced by #457
- bump to 2.4.2rc2
02/19/2020
- if content was already returned via html/http send then don't return 500
but send 200 to avoid extraneous internal error document text to be sent
on some Apache 2.4.x versions e.g. CentOS 7
- bump to 2.4.2rc1
02/03/2020
- if OIDCPublicKeyFiles contains a certificate, the corresponding x5c, x5t and x5t#256
parameters will be added to the generated jwkset available at "<redirect_uri>?jwks=rsa"
thanks @absynth76
- fix: also add SameSite=None to by-value session cookies
- bump to 2.4.2rc0
01/30/2020
- try to fix graceful restart crash; see #458
- release 2.4.1
01/29/2020
- always add a SameSite value to the Set-Cookie header to satisfy upcoming Chrome/Firefox changes
this can be overridden by using, e.g.:
SetEnvIf User-Agent ".*IOS.*" OIDC_SET_COOKIE_APPEND=;
- release 2.4.1rc6
01/22/2020
- URL encode logout url in session management JS; thanks Paolo Battino
- bump to 2.4.1rc5
01/15/2020
- add value of OIDC_SET_COOKIE_APPEND env var to Set-Cookie headers
useful for handling changing/upcoming SameSite behaviors across different browsers, e.g.:
SetEnvIf User-Agent ".*IOS.*" OIDC_SET_COOKIE_APPEND=SameSite=None
- bump to 2.4.1rc4
01/08/2020
- support 407 option on OIDCUnAuthAction
12/09/2019
- fix parsing of values from metadata files when the default is non-NULL (e.g. UNSET)
- enforce OIDCIDTokenSignedResponseAlg and OIDCUserInfoSignedResponseAlg; see #435
- bump to 2.4.1rc2
- support login with OIDC session management; address #456
- bump to 2.4.1rc3
12/05/2019
- add the possibility to use a public key instead of a certificate for OIDCPublicKeyFiles parameter
- added an alpine dockerfile =~ 20MB container size
12/04/2019
- return 200 OK for backchannel logout if session not found
- bump to 2.4.1rc1
11/19/2019
- make cleaning of expired state cookies log with a warning rather than an error; thanks Pavel Drobov
- bump to 2.4.1rc0
10/03/2019
- improve validation of the post-logout URL parameter on logout; thanks AIMOTO Norihito; closes #449
- release 2.4.0.3
- clear any existing chunked cookies when setting a non-chunked cookie; prevents login loops in some scenarios
08/28/2019
- fixes #447 #441 : changed storing POST params from localStorage to
sessionStorage due to some issue of losing data in localStorage in Firefox
(private mode)
08/22/2019
- release 2.4.0
08/16/2019
- revert 3d95b4a3fbc493c6acc745626ac33143eb4968bf: don't return early from the content handler
08/15/2019
- be smart about picking the token endpoint authentication method when not configured explicitly:
don't choose the first one published by the OP but prefer client_secret_basic if that is listed as well
see: panva/node-oidc-provider#514; thanks @richard-drummond and @panva
- bump to 2.4.0rc24
08/12/2019
- fix not clearing claims in session when setting claims to null; closes #445; thanks @FilipVujicic
08/12/2019
- fix JWT decryption crashing on non-null terminated input
- bump to 2.4.0rc23
08/09/2019
- add logout_on_error option to OIDCRefreshAccessTokenBeforeExpiry to kill the session when
refreshing an access token fails; thanks @rickyepoderi
- bump to 2.4.0rc22
08/08/2019
- no longer use the fixup handler for environment variable setting but do it as part of the authn handler
- bump to 2.4.0rc21
08/04/2019
- avoid decoding non-form-encoded POST data; closes #443
- bump to 2.4.0rc20
08/02/2019
- return DONE from the content handler early to prevent triggering other content handlers
- fix `OIDCOAuthAcceptTokenAs post` so POST data is propagated and not lost; see #443
- bump to 2.4.0rc19
07/10/2019
- fix RSA JWK "x5c" parsing issue (e.g. when parsing "n" fails): explicitly set the "kid" into to JWK
- bump to 2.4.0rc18
06/19/2019
- fix regression bug that includes a HTTP 500 message after rendering content
- bump to 2.4.0rc17
06/14/2019
- fix regression bug when no per-provider keys have been configured and private_key_jwt is used
- bump to 2.4.0rc15
06/06/2019
- use per-provider signing keys in private_key_jwt authentication towards token endpoint
- bump to 2.4.0rc14
06/05/2019
- avoid passing empty key set for JWT decryption (solve but introduced in 2.4.0rc12)
- bump to 2.4.0rc13
06/03/2019
- enable per-provider signing and encryption keys; limitations:
- for request object signing and id_token decryption only
- take the first configured key, no kid specification
- no publishing of key information on client endpoints
- no userinfo JWT decryption
- no composite claims decryption
- no backchannel logout with encrypted logout token (inherent)
- bump to 2.4.0rc12
05/31/2019
- make sure the content handler is called for every request to the configured Redirect URI so all
Apache processing is executed (e.g. setting headers with mod_headers) before returning the response
thanks Don Sengpiehl (NB: this may affect browser behavior and backwards compatibility)
- add ability to view session info in HTML via the session info hook: <redirect_uri)?info=html
- bump to 2.4.0rc11
05/24/2019
- fix oidc_proto_html_post auto-post-submit so it no longer results in duplicate parentheses
closes #440; thanks @gobreak
- bump to 2.4.0rc10
05/21/2019
- log the original URL for expired state cookies, useful for debugging SPA/JS issues
05/17/2019
- allow removing an access token from the cache ("remove_at_cache") when running in OAuth 2.0 RS mode only
- support refresh and access tokens revocation from an RFC 7009 endpoint upon OIDC session logout
- bump to 2.4.0rc9
05/03/2019
- fix (cached) parsing of OIDCOAuthServerMetadataURL; thanks Lance Fannin
- bump to 2.4.0rc5
05/02/2019
- correct caching for OIDCOAuthServerMetadataURL
- bump to 2.4.0rc4
04/21/2019
- remove option to skip scrubbing request headers (thus avoiding potentionally insecure setups)
- bump to 2.4.0rc3
04/19/2019
- add USE_URANDOM compile time option to use /dev/urandom explicitly for non-blocking random number generation
configure with APXS2_OPTS="-DUSE_URANDOM"
- bump to 2.4.0rc2
04/15/2019
- add debug logs in oidc_proto_generate_random_string
- URL-encode client_id/client_secret when using client_secret_basic according to: https://tools.ietf.org/html/rfc6749#section-2.3.1
- bump to 2.4.0rc1
04/09/2019
- deprecate the OAuth 2.0 Resource Server functionality
- bump to 2.4.0rc0
03/13/2019
- release 2.3.11
02/26/2019
- add session expiry to session info hook response (and change inactivity timeout key)
- bump to 2.3.11rc2
02/25/2019
- add option to dynamically pass query parameters to the authorization request; closes #401
- bump to 2.3.11rc1
01/31/2019
- support conditional compilation of memcache support
- bump to 2.3.11rc0
01/22/2019
- fix XSS vulnerability CSNC-2019-001 wrt. poll parameter in OIDC Session Management RP iframe; thanks Mischa Bachmann
- release 2.3.10.2
01/16/2019
- fix bug in current URL detection where query parameters would be duplicated; see #420; thanks @jreynaert
- release 2.3.10.1
12/31/2018
- fix warning printout in oidc_delete_oldest_state_cookies
- release 2.3.10
12/16/2018
- fix encryption buffer tag length mismatch
12/06/2018
- retain the unparsed URL path in current/original URL determination, and thereby preserve
and support URL-encoded characters in paths when redirecting back to the original URL
- add state to code exchange token requests only in multi-provider setups; see #402
- optionally delete the oldest state cookie(s); see #399
- bump to 2.3.10rc3
11/29/2018
- add support for refreshing an access token associated with an OIDC session using OIDCRefreshAccessTokenBeforeExpiry
- bump to 2.3.10rc0
11/15/2018
- release 2.3.9
11/13/2018
- fix parsing of cookie name in OIDCOAuthAcceptTokenAs when the cookie option is not listed last
- bump to 2.3.9rc7
11/12/2018
- fix OAuth 2.0 RS config check when OIDCOAuthServerMetadataURL is set; thanks @psteniusubi
- bump to 2.3.9rc6
10/24/2018
- add support for draft https://www.ietf.org/id/draft-ietf-oauth-mtls-12.txt:
OAuth 2.0 Mutual TLS Client Certificate Bound Access Tokens
when running as an OAuth 2.0 RS, validating cnf["x5t#S256"] claims.
- bump to 2.3.9rc5
10/17/2018
- ignore/trim spaces in X-Forwarded-* headers
- deal with forwarding proxy setups; see #395 ; thanks @archzone
- bump to 2.3.9rc4
10/02/2018
- improve OIDC backchannel logout based on config/Discover
- add OIDCProviderBackChannelLogoutSupported config primitive
- parse/interpret `backchannel_logout_supported` in Discovery document
- add `id_token_token_binding_cnf`: `tbh` to dynamic client registration metadata
- bump to 2.3.9rc3
10/01/2018
- support backchannel logout according to: https://openid.net/specs/openid-connect-backchannel-1_0.html
- bump to 2.3.9rc2
10/01/2018
- add test-cmd command to generate hashes base64urlencoded inputs (cnf/tbh claims)
09/30/2018
- support Token Binding for Access Tokens according to: https://tools.ietf.org/html/draft-ietf-oauth-token-binding
- bump to 2.3.9rc1
09/16/2018
- support nested arrays in Require claim authorization evaluation; see #392; thanks @hpbieker
- bump to 2.3.9rc0
09/12/2018
- fix return result FALSE when JWT payload parsing fails; see #389; thanks @amdonov
- release 2.3.8
08/30/2018
- add LGTM code quality badges, see #385; thanks @xcorail
- fix 3 LGTM alerts
08/23/2018
- improve auto-detection of XMLHttpRequests via Accept header; see #331
- bump to 2.3.8rc5
08/15/2018
- initialize test_proto_authorization_request properly; see #382; thanks @jdennis
- add sanity check on provider->auth_request_method; closes #382; thanks @jdennis
- bump to 2.3.8rc4
08/14/2018
- allow usage with LibreSSL; closes #380; thanks @hihellobolke
- bump to 2.3.8rc3
08/04/2018
- don't return content with 503 since it will turn the HTTP status code into a 200; see #331
- bump to 2.3.8rc2
08/03/2018
- add option to set an upper limit to the number of concurrent state cookies via OIDCStateMaxNumberOfCookies; see #331
- make the default maximum number of parallel state cookies 7 instead of unlimited; see #331
- bump to 2.3.8rc1
07/30/2018
- fix using access token as endpoint auth method in introspection calls; closes #377; thanks @skauffmann
07/25/2018
- fix reading access_token form POST parameters when combined with `AuthType auth-openidc`; see #376; thanks Nicolas Salerno
- bump to 2.3.8rc0
07/06/2018
- abort when string length for remote user name substitution is larger than 255 characters
- release 2.3.7
07/04/2018
- fix Redis concurrency issue when used with multiple vhosts
- bump to 2.3.7rc4 and 2.3.7rc5
06/29/2018
- add support for authorization server metadata with OIDCOAuthServerMetadataURL as in RFC 8414
- bump to 2.3.7rc3
06/23/2018
- refactor session object creation
- bump to 2.3.7rc2
06/22/2018
- clear session cookie and contents if cache corruption is detected
- bump to 2.3.7rc0
- use apr_pstrdup when setting r->user
- reserve 255 characters in remote username substition instead of 50
- bump to 2.3.7rc1
06/15/2018
- add check to detect session cache corruption for server-based caches and cached static metadata
- release 2.3.6
05/29/2018
- avoid using pipelining for Redis
- bump to 2.3.6rc4
05/28/2018
- send Basic header in OAuth www-authenticate response if that's the only accepted method; thanks @puiterwijk
05/28/2018
- refactor Redis cache backend to solve issues on AUTH errors: a) memory leak and b) redisGetReply lagging behind
- adjust copyright year/org
- bump to 2.3.6rc3
05/23/2018
- fix buffer overflow in shm cache key set strcpy; thanks @kyprizel
- bump to 2.3.6rc2
05/22/2018
- turn missing session_state from warning into a debug statement
- fix missing "return" on error return from the OP; see #345; thanks @gergan
- bump to 2.3.6rc1
05/19/2018
- explicitly set encryption kid so we're compatible with cjose >= 0.6.0
- bump to 2.3.6rc0
05/18/2018
- fix encoding of preserved POST data; see #338; thanks @timpuri
- avoid buffer overflow in shm cache key construction; thanks @kyprizel
- release 2.3.5
05/08/2018
- compile with with Libressl; closes #358; thanks @hihellobolke
- bump to 2.3.5rc0
04/27/2018
- avoid crash when a relative logout URL parameter is passed in; thanks Vivien Delenne
- release 2.3.4
03/22/2018
- interpret X-Forwarded-Host when doing XSRF protection on the after-logout URL; see #341; thanks @pepe79
- bump to 2.3.4rc4
02/06/2018
- add support for passing an access token in a HTTP Basic authentication password; thanks @puiterwijk
- bump to 2.3.4rc3
01/26/2018
- send session management Javascript logging to debug; thanks @kerrermanisNL
01/25/2018
- add Cache-Control no-cache header to authorization requests to avoid replays of state/nonce; see #321
- bump to 2.3.4rc2
01/23/2018
- add explicit endpoint authentication method "bearer_access_token"
12/29/2017
- correct documentation on kid usage for OIDCOAuthVerifyCertFiles; closes #318
12/21/2017
- fix compiler warnings for OpenSSL 1.1.x
- bump to 2.3.4rc1
11/21/2017
- fix bug where endpoint authentication method "private_key_jwt" would not co-exist with "none"
- bump to 2.3.4rc0
11/16/2017
- add support for passing userinfo as a JSON object or JWT; see #311
- release 2.3.3
11/13/2017
- add support for authentication to the introspection endpoint with a bearer token using OIDCOAuthIntrospectionClientAuthBearerToken; thanks @cristichiru
- bump to 2.3.3rc3
11/08/2017
- address a number of static code analysis issues
- bump to 2.3.3rc2
10/10/2017
- avoid crash when no scheme is set on OIDCProviderMetadataURL; closes #303; thanks @iconoeugen
- bump to 2.3.3rc1
10/6/2017
- avoid crash when no OIDCOAuthClientID is set for remote access token validation
- don't enforce "iat" slack checks on locally validaed JWT access tokens
- bump to 2.3.3rc0
09/18/2017
- release 2.3.2
09/11/2017
- fix "graceful" restart for shm/redis cache backends; see #296
- bump to 2.3.2rc8
09/05/2017
- optionally remove request object parameters from the authorization request URL with "copy_and_remove_from_request"; see #294
- bump to 2.3.2rc7
08/29/2017
- properly support JSON boolean values in metadata .conf files
- add regex substitution for *RemoteUserClaim; thanks @hihellobolke
- bump to 2.3.2rc6
08/27/2017
- add issuer specific redirect URI option ("issuer_specific_redirect_uri") for multi-provider setups to mitigate IDP mixup
- bump to 2.3.2rc5
08/20/2017
- fix public clients; add endpoint authentication method "none"
- bump to 2.3.2rc4
08/02/2017
- update experimental token binding support to https://tools.ietf.org/html/draft-ietf-tokbind-ttrp-01
and use header names prefixed with "Sec-"; depends on mod_token_binding >= 0.3.4 now
- bump to 2.3.2rc3
08/01/2017
- don't abort when mutex operations fail
- printout textual descriptions of errors returned by mutex operations
- bump to 2.3.2rc2
07/28/2017
- fix issue with the combination of shared memory (shm) cache and using encryption (OIDCCacheEncrypt On)
where the cache value would be corrupted after the first (successful) retrieval
- bump to 2.3.2rc1
07/27/2017
- support paths that are relative to the Apache root dir for:
OIDCHTMLErrorTemplate, OIDCPublicKeyFiles, OIDCPrivateKeyFiles,
OIDCOAuthVerifyCertFiles, OIDCClientTokenEndpointCert, OIDCClientTokenEndpointKey,
OIDCOAuthIntrospectionEndpointCert and OIDCOAuthIntrospectionEndpointKey
- bump to 2.3.2rc0
07/19/2017
- handle multiple values in X-Forwarded-* headers as to better support chains of reverse proxies in front of mod_auth_openidc
- log request headers in oidc_util_hdr_in_get
- release 2.3.1
07/13/2017
- remove A128GCM/A192GCM from the supported algorithms in docs/auth_openidc.conf
because cjose doesn't support A128GCM and A192GCM (yet)
- bump to 2.3.1rc5
07/09/2017
- refactor oidc_get_current_url_port so that it assumes the default port when
X-Forwarded-Proto has been set; closes #282 and may address #278
- bump to 2.3.1rc4
07/07/2017
- use the defined name (`Provided-Token-Binding-ID`) for the provided token binding ID HTTP header
see: https://tools.ietf.org/html/draft-campbell-tokbind-ttrp-00#section-2.1
depends on mod_token_binding >= 0.3.0 now
- bump to 2.3.1rc3
06/29/2017
- support sending the authentication request via HTTP POST through HTML/Javascript autosubmit
- bump to 2.3.1rc2
06/28/2017
- support private_key_jwt and client_secret_jwt as client authentication methods for token introspection
- bump to 2.3.1rc1
06/22/2017
- fix bug where token_endpoint_auth set to private_key_jwt would fail to provide the credential if client_secret wasn't set
- bump to 2.3.1rc0
06/13/2017
- release 2.3.0
06/07/2017
- fix file cache backend: allow caching of non-filename friendly keys such as configuration URLs and JWKs URIs
- enable JQ-based claims expression matching when compiled from source with --with-jq=<dir>, e.g.:
Require claims_expr '.aud == "ac_oic_client" and (.scope | index("profile") != null)'
- normalize cache backend logging
- bump to 2.3.0rc3
06/06/2017
- avoid cleaning our own state cookie twice when it is expired
- bump to 2.3.0rc2
06/02/2017
- refactor remote user handling so it allows for postfixing with the issuer value after applying the regex
- bump to 2.3.0rc1
05/31/2017
- add support for custom actions to take after authorization fails with OIDCUnAutzAction
this enables stepup authentication scenarios when combined with the following:
- add OIDCPathAuthRequestParams that is configurable on a per-path basis and use OIDCAuthRequestParams for the static per-provider value
- add OIDCPathScope that is configurable on a per-path basis and concatenate with OIDCScope as static per-provider value
- support 3rd-party-init-SSO with additional authentication request params when a single static provider has been configured
- add support for an empty OIDCClaimPrefix; can be used with OIDCWhiteListedClaims to protect selected headers
- bump to 2.3.0rc0
05/30/2017
- support sending Authorization Request as "request" object in addition to "request_uri"; thanks @suttod
- support nested claim matching in Require directives; thanks @suttod
- support explicitly setting the "kid" of the private key in OIDCPrivateKeyFiles; thanks @suttod
05/25/2017
- fix cache fallback so it happens (when enabled) only after failure
05/19/2017
- make OIDCStripCookies work on AuthType oauth20 paths; closes #273; thanks Michele Danieli
- bump to 2.2.1rc6
05/18/2017
- fix parse function of OIDCRequestObject configuration option; thanks @suttod
05/17/2017
- avoid crash when the X-Forwarded-Proto header is not correctly set by a reverse proxy in front of mod_auth_openidc
05/14/2017
- support JWT verification against multiple keys with no provided kid by looping over the provided keys with cjose 0.5.0
- remove OIDC RP certification files; moved to separate repository
05/04/2017
- improve documentation for OIDCCryptoPassphrase; closes #268
04/30/2017
- fix wrong return value for cache_file_set in the file cache backend (OIDCCacheType file); thanks Ernani Joppert Pontes Martins
- bump to 2.2.1rc5
04/29/2017
- correctly log success/failure in cache_file_set
- avoid decoding a JSON object and logging an error when the input is NULL
e.g. when claims have not been resolved because userinfo endpoint is not set
04/20/2017
- support relative RedirectURIs; closes #200; thanks @moschlar
- don't assume that having OIDCCryptPassphrase set means we should validate the config for
openid-connect since it can now also be used to encrypt (auth20) cache entries
- bump to 2.2.1rc4
04/08/2017
- fix potential crash on prefork process exit when used with Redis cache backend (3x)
- bump to 2.2.1rc3
04/06/2017
- change warn log about missing token binding ID to debug log
04/05/2017
- allow for high session inactivity timeout max value
- improve error message in oidc_util_http_send when ap_pass_brigade fails and mention possible interference with mod_deflate
- bump to 2.2.1rc0
03/30/2017
- merge feature branch back to master:
- better support for Single Page Applications, see:
https://github.com/zmartzone/mod_auth_openidc/wiki/Single-Page-Applications
- add session info hook that is configurable through OIDCInfoHook
- add "AuthType auth-openidc" option that allows both "oauth20" and "openid-connect" on the same path
- add encryption for all cache entries instead of just session data through OIDCCacheEncrypt
- add cookie SameSite flag/policy through OIDCCookieSameSite
- return HTTP 200 on OPTIONS requests to (unauthenticated) "oauth20" paths
- add fallback to a by-value session cookie if the primary session cache fails with OIDCSessionCacheFallbackToCookie
- add support for black- and/or white-listing claims with OIDCBlackListedClaims and OIDCWhiteListedClaims
- add prototype token binding support in conjunction with:
https://github.com/zmartzone/mod_token_binding:
- for state & session cookies, see:
https://github.com/TokenBinding/Internet-Drafts
- for ID tokens with OpenID Connect Token Bound Authentication support, see:
http://openid.net/specs/openid-connect-token-bound-authentication-1_0.html
- for Authorization Codes with OAuth 2.0 Token Binding for Authorization Codes, see:
https://tools.ietf.org/html/draft-ietf-oauth-token-binding
- refactoring:
- refactor session state, proto state and headers into getters/setters functions
- refactor PKCE support
- fix removing session state from cache on logout
- fix clearing chunked session cookies on logout; closes #246; thanks @Jharmuth
- release 2.2.0
02/20/2017
- security fix: scrub headers for "AuthType oauth20"
- release 2.1.6
02/15/2017
- improve logging of session max duration and session inactivity timeout
- refactor so that the call to the refresh hook also resets the session inactivity timeout and passes tokens down
02/14/2017
- treat only "X-Requested-With: XMLHttpRequest" header as a non-browser client; closes #228 ; thanks @mguillem
- improve error message on state timeout; closes #226; thanks @security4java
02/09/2017
- correctly parse "kid" in OIDCPublicKeyFiles and OIDCOAuthVerifyCertFiles; thanks Alessandro Papacci
- bump to 2.1.6rc2
02/07/2017
- fix parsing of mandatory/optional attribute in OIDCOAuthTokenExpiryClaim; closes #225; thanks Alessandro Papacci
- bump to 2.1.6rc1
02/06/2017
- improve logging around the availability of session management; closes #223
02/02/2017
- interpret OIDCUnAuthAction also when the maximum session duration has been exceeded; see #220
- bump to 2.1.6rc0
01/30/2017
- security fix: scrub headers when `OIDCUnAuthAction pass` is used for an unauthenticated user
- release 2.1.5
01/29/2017
- fix error message about passing id_token with session type client-cookie; mentioned in #220
- bump to 2.1.5rc0
01/25/2017
- release 2.1.4
01/18/2017
- don't echo the query parameters on the error page when an invalid request is made to the Redirect URI; closes #212; thanks @LukasReschke
01/14/2017
- use dynamic memory buffer for writing HTTP call responses; solves curl/mpm-event interference; see #207
- bump to 2.1.4rc1
01/10/2017
- don't crash when data is POST-ed to the redirect URL, it has just 1 POST parameter and it is not "response_mode"
01/2/2017
- remove trailing linebreaks from input in test-cmd tool
- bump copyright year to 2017
12/14/2016
- support Libre SSL, see #205, thanks @AliceWonderMiscreations
- update OIDC logout support to Front-Channel Logout 1.0 draft 01: http://openid.net/specs/openid-connect-frontchannel-1_0.html
- bump to 2.1.4rc0
12/13/2016
- release 2.1.3
12/12/2016
- don't rollover session id's and keep the same session cookie name for cache storage over session updates
- bump to 2.1.3rc0
11/19/2016
- release 2.1.2
11/18/2016
- fix crash when searching for keys with a kid, there's no initial match and x5t values exist for the non-matching keys; closes #196
11/9/2016
- remove stale claims from session when refreshing them from the userinfo endpoint fails; addresses #194
- release 2.1.1
11/8/2016
- log readable error messages when memcache operations fail
11/6/2016
- fix memory leak when skipping jwks_uri keys with a non-matching "use" value
11/4/2016
- always restore id_token/claims on sub-requests so e.g. listing claims-protected subdirectories will work
- remove obsolete functions for storing the session in the request state
- bump to 2.1.1rc0
11/3/2016
- remove obsolete sessions from session cache; thanks @stevedave
11/1/2016
- release version 2.1.0
10/28/2016
- don't include encryption keys from the jwks_uri when verifying a JWT and no kid has been specified
- fix memory leaks in composite claim handling
10/27/2016
- handle aggregated and distributed claims from the userinfo endpoint
- only pick private_key_jwt token endpoint authentication if a private key is configured; closes #189
- bump to 2.0.1rc7
10/24/2016
- add OpenID Connect RP certification test script
- handle non-integer exp/iat timestamps; closes #187; thanks @drdivano
10/21/2016
- bugfix: first truncate files before writing them
- support refreshing provider metadata based on timestamp and OIDCProviderMetadataRefreshInterval
10/20/2016
- bugfix: correctly truncate encryption keys derived from client secret for algorithms that require a key size < 256 bits
- add test/test-cmd tool
- bugfix: return error on session cache failures; closes #185; thanks @solsson
- bump to 2.0.1rc6
10/18/2016
- bugfix: JWTs with a header that doesn't specify a `kid` that would not validate when used with more than 1 key; closes #184; thanks @solsson
- bump to 2.0.1rc5
10/13/2016
- urlencode provider URL cache key to fix file cache backend issue; closes #179, thanks @djahandarie
10/9/2016
- fix null pointer segfault in debug printout in oidc_util_read_form_encoded_params
- fix OIDCOAuthAcceptTokenAs parsing flaw introduced in 2.0.0rc5
- bump to 2.0.1rc4
10/2/2016
- support presenting the access token to the userinfo endpoint in a POST parameter
- bump to 2.0.1rc3
9/30/2016
- support WebFinger Discovery with URL-style user identifiers
9/28/2016
- fix memory leak in oidc_jwk_to_json
- add "remove_at_cache" hook; addresses #177
- bump to 2.0.1rc2
9/27/2016
- add support for Request URI with signed and/or encrypted Request Objects
- bump to 2.0.1rc1
9/22/2016
- refuse webfinger responses with an href value that is not on secure https
- add userinfo JWT response verification and decryption
9/20/2016
- log the JWT header before optional decryption is applied
9/19/2016
- check that a sub claim returned from the userinfo endpoint matches the one in the id_token
- fix issue in oidc_metadata_parse_url so that static default would not be honored
- this only affected server-wide OIDCClientJwksUri usage in dynamic client registration
- non-functional changes for OIDC RP certification:
- explicitly log the client authentication method when calling the token endpoint
- log the keys that are included for token verification
- bump to 2.0.1rc0
9/9/2016
- fix overriding provider token endpoint auth with static config when not set in .conf file
- don't add our own cookies to the incoming headers
- allow stripping cookies from the Cookie header sent to the application/backend with OIDCStripCookies