OpenID Connect: ask for the audience in setup, flag open directories #143

Merged

jcoffey-dev merged 2 commits from sec/batch-3 into main

2026-10-29 13:18:36 +00:00

jcoffey-dev commented

2026-10-29 13:10:02 +00:00

Owner

Console side of the server's OpenID Connect changes (inbuxa-server #231, in 2026.10.29.1 and 27.1-rc.3).

Directory setup: the guided OpenID Connect setup asks for the provider's client ID and saves it as the required audience, which new directories now need.
Security to-do list: two new checks flag an OpenID Connect directory with no required audience (SS-30) and one that accepts opaque tokens on the user info endpoint's word (SS-31).

The directory form itself is built from the server's schema, so the new opaque-token fields need no console code. Checked locally: typecheck, lint, i18n:check, notice-check and the tests pass.

Console side of the server's OpenID Connect changes (inbuxa-server #231, in 2026.10.29.1 and 27.1-rc.3). - Directory setup: the guided OpenID Connect setup asks for the provider's client ID and saves it as the required audience, which new directories now need. - Security to-do list: two new checks flag an OpenID Connect directory with no required audience (SS-30) and one that accepts opaque tokens on the user info endpoint's word (SS-31). The directory form itself is built from the server's schema, so the new opaque-token fields need no console code. Checked locally: typecheck, lint, i18n:check, notice-check and the tests pass.

jcoffey-dev added 2 commits 2026-10-29 13:10:02 +00:00

Directory setup: ask an OpenID Connect provider's client ID as the audience efea8c3fdd

The server now refuses a new OpenID Connect directory without a required
audience, since without one a token the provider issued to any other
application signs people in. The guide's connection step asks for the
client ID inbuxa is registered with at the provider, can't go on
without it, and saves it as requireAudience.

Test: the presets test builds an OIDC directory with requireAudience
from the audience typed (it had none before); typecheck, lint and the
full test run pass.

Security: flag OpenID Connect directories open to other apps' tokens

ci / build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

ci / notices (pull_request) Successful in 18s

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 2m6s

Details

2b37d229ae

Two new checks on the security to-do list read every directory:

- SS-30, important: an OpenID Connect directory with no required
  audience (only one saved before the server required it can be like
  this). Tokens its provider issued to other applications sign in.
- SS-31, important: an OpenID Connect directory that takes tokens which
  aren't JWTs on the user info endpoint's word (opaqueTokens: userinfo,
  which directories saved before the setting existed read as). Any
  token the provider issued, to any application, passes.

Both are Reviews that open the directory. They are numbered past the
spec's requirements, SS-19 to SS-29, which share the numbering; the
server keeps acceptances for checks up to SS-40. The page help lists
them after SS-18.

Test: the checks test flags the old directory for both and leaves a
directory with an audience, one using introspection and an LDAP one
alone; the help test still finds every check explained once, in order.

jcoffey-dev merged commit e48e9a59dd into main

2026-10-29 13:18:36 +00:00

jcoffey-dev deleted branch sec/batch-3

2026-10-29 13:18:36 +00:00

jcoffey-dev referenced this issue from a commit

2026-10-29 17:15:37 +00:00

Version 27.1-rc.3

jcoffey-dev referenced this pull request

2026-10-29 17:15:45 +00:00

Version 27.1-rc.3 #144

jcoffey-dev referenced this pull request

2026-11-01 16:19:18 +00:00