- an authenticator removed or re-enrolled would continue to allow old
API Session to operate
- deleted or re-enrolled authenticators now remove associatd API
Sessions
- events during a multi-step transaction were immediately emitting events
causing out of order and incomplete events to be received,
specifically API Sessions w/o fingerprints
- API Session Certificates created implicitly during 3rd Party CA auth
did not properly set all properties
- adds tests
- ext-jwt-signers now support jwks endpoints in addition to static
certificates
- ext-jwt-signers now require either kid+cert or jkwsEndpoint
- ext-jwt-signers now requires issuer and audience fields
- jwksEndpoints are initially cached and will be revalidated on invalid
auth once every 5s at most
- adds more external id tests
- adds REST API CA external id field
- adds rest api for external fields
- refactors authentication interfaces for federation
- alters authentication moduels to return AuthResult interfaces
- allows AuthResults to provide external x509 certs as session certs
- adds endpoint POST /edge/management/v1/authenticator/{id}/extend
- adds endpoint POST /edge/management/v1/authenticator/{id}/extend-verify
- adds endpoint POST /edge/client/v1/authenticator/{id}/extend
- adds endpoint POST /edge/client/v1/authenticator/{id}/extend-verify
- add logic that allows a client endpoint to extend the valid period for
their current certificate authenticator
- requires clients to use their existing client cetificate for extension
- requires clients to verify they have received the new public key
- allows clients to use a new private key if desired
- allows only 1st party certificate authenticators to extend
- adds authenticatorId to apiSession for persistence, model, api model
- add session cert to already authenticated session on extend
- removes empty test stub
Paul Lorenz