Hotfix 2026.10.26.4: OpenID Connect audience in the console #158

Merged

jcoffey-dev merged 5 commits from hotfix/oidc-audience into release/2026 2026-11-01 16:21:28 +00:00

Conversation 0 Commits 5 Files Changed 12

+159 -13

5 Commits

Author	SHA1	Message	Date
jcoffey-dev	f131071bde	Version 2026.10.26.4	2026-11-01 09:14:03 -07:00
jcoffey-dev	a022ce4d2b	CI: leave :latest to the newest series once 27.1 ships ... A dated release from this branch moved :latest, GHCR's :latest and the GitHub "latest release" on every tag. That is right while 2026.x is the newest series, and wrong once 27.1 ships: a security release from this branch would take :latest back to the older line. Both CIs now ask Gitea for the newest final releases and move :latest only while none is numbered by series (v27.1, v27.1.3), so the switch happens on its own when 27.1 is published. The check fails rather than guess. The inherited v1.0.x numbers don't count as a series.	2026-11-01 09:14:03 -07:00
jcoffey-dev	b2d29b836c	GitHub release copy: wait for the release files ... github-release needed only publish, so it ran beside files and copied the Gitea release before files had attached the tarball and SHA256SUMS. Every GitHub copy of a release had no files. It now needs files too. (cherry picked from commit 56a4caea72)	2026-11-01 09:13:00 -07:00
jcoffey-dev	fb4679c418	Security: flag OpenID Connect directories open to other apps' tokens ... Two new checks on the security to-do list read every directory: - SS-30, important: an OpenID Connect directory with no required audience (only one saved before the server required it can be like this). Tokens its provider issued to other applications sign in. - SS-31, important: an OpenID Connect directory that takes tokens which aren't JWTs on the user info endpoint's word (opaqueTokens: userinfo, which directories saved before the setting existed read as). Any token the provider issued, to any application, passes. Both are Reviews that open the directory. They are numbered past the spec's requirements, SS-19 to SS-29, which share the numbering; the server keeps acceptances for checks up to SS-40. The page help lists them after SS-18. Test: the checks test flags the old directory for both and leaves a directory with an audience, one using introspection and an LDAP one alone; the help test still finds every check explained once, in order. (cherry picked from commit 2b37d229ae)	2026-11-01 09:13:00 -07:00
jcoffey-dev	b7a178b1a9	Directory setup: ask an OpenID Connect provider's client ID as the audience ... The server now refuses a new OpenID Connect directory without a required audience, since without one a token the provider issued to any other application signs people in. The guide's connection step asks for the client ID inbuxa is registered with at the provider, can't go on without it, and saves it as requireAudience. Test: the presets test builds an OIDC directory with requireAudience from the audience typed (it had none before); typecheck, lint and the full test run pass. (cherry picked from commit efea8c3fdd)	2026-11-01 09:13:00 -07:00