OpenID Connect: ask for the audience in setup, flag open directories #143

Merged

jcoffey-dev merged 2 commits from sec/batch-3 into main 2026-10-29 13:18:36 +00:00

Conversation 0 Commits 2 Files Changed 9

+116 -5

2 Commits

Author	SHA1	Message	Date
jcoffey-dev	2b37d229ae	Security: flag OpenID Connect directories open to other apps' tokens ... Two new checks on the security to-do list read every directory: - SS-30, important: an OpenID Connect directory with no required audience (only one saved before the server required it can be like this). Tokens its provider issued to other applications sign in. - SS-31, important: an OpenID Connect directory that takes tokens which aren't JWTs on the user info endpoint's word (opaqueTokens: userinfo, which directories saved before the setting existed read as). Any token the provider issued, to any application, passes. Both are Reviews that open the directory. They are numbered past the spec's requirements, SS-19 to SS-29, which share the numbering; the server keeps acceptances for checks up to SS-40. The page help lists them after SS-18. Test: the checks test flags the old directory for both and leaves a directory with an audience, one using introspection and an LDAP one alone; the help test still finds every check explained once, in order.	2026-10-29 02:17:27 -07:00
jcoffey-dev	efea8c3fdd	Directory setup: ask an OpenID Connect provider's client ID as the audience ... The server now refuses a new OpenID Connect directory without a required audience, since without one a token the provider issued to any other application signs people in. The guide's connection step asks for the client ID inbuxa is registered with at the provider, can't go on without it, and saves it as requireAudience. Test: the presets test builds an OIDC directory with requireAudience from the audience typed (it had none before); typecheck, lint and the full test run pass.	2026-10-29 02:17:27 -07:00