- ext-jwt-signers now support jwks endpoints in addition to static
certificates
- ext-jwt-signers now require either kid+cert or jkwsEndpoint
- ext-jwt-signers now requires issuer and audience fields
- jwksEndpoints are initially cached and will be revalidated on invalid
auth once every 5s at most
- adds more external id tests
- adds a new posture check for dealing with multiple processes
- supports anyOf and allOf semantics
- does not require new posture responses, current process responses
suffice
- tests
Paul Lorenz