- an authenticator removed or re-enrolled would continue to allow old
API Session to operate
- deleted or re-enrolled authenticators now remove associatd API
Sessions
- adds REST API CA external id field
- adds rest api for external fields
- refactors authentication interfaces for federation
- alters authentication moduels to return AuthResult interfaces
- allows AuthResults to provide external x509 certs as session certs
- adds endpoint POST /edge/management/v1/authenticator/{id}/extend
- adds endpoint POST /edge/management/v1/authenticator/{id}/extend-verify
- adds endpoint POST /edge/client/v1/authenticator/{id}/extend
- adds endpoint POST /edge/client/v1/authenticator/{id}/extend-verify
- add logic that allows a client endpoint to extend the valid period for
their current certificate authenticator
- requires clients to use their existing client cetificate for extension
- requires clients to verify they have received the new public key
- allows clients to use a new private key if desired
- allows only 1st party certificate authenticators to extend
- adds authenticatorId to apiSession for persistence, model, api model
- add session cert to already authenticated session on extend
- removes empty test stub
- update for identities does not allow enrol/auth/default admin to be
updated
- adds migrations to fix broken data models between ident/auth/enrol
- fixes migration not to be stuck at version 4
Paul Lorenz