ziti/controller/oidc_auth at d8cedeb8ea1813221808f3da556a8fc59efae431 - ziti

mirror of https://github.com/openziti/ziti.git synced 2026-09-11 13:29:03 +00:00

Files

T

Björn Mage 4a8b63d99d fix(oidc_auth): hex-encode peer signer kid in KeySet() (#4068 )

KeySet() formatted a peer controller's SHA1 cert fingerprint with %s
instead of %x, producing an undecodable raw-byte kid in the /oidc/keys
JWKS response for every entry sourced from GetPeerSigners(). The
error-path logging four lines below this already used %x correctly.

In a multi-controller raft HA deployment, each controller signs
OIDC/OTT JWTs with its own root ctrl-plane-identity key. A JWKS lookup
landing on a controller other than the signer sees the true signer's
key advertised under this corrupt kid and cannot match it against the
token's kid header, failing verification.

Fixes #4067

Co-authored-by: Björn Mage <4495532+bjornmage@users.noreply.github.com>

2026-07-07 20:23:06 -04:00

resources

adds support OIDC authentication, api access, and ER connections

2023-07-20 09:41:12 -04:00

client.go

fixes #3788 return proper OIDC error codes and HTTP status codes (#3790 )

2026-04-14 16:44:06 -04:00

config.go

Enforce api-session and identity revocations on the router. Fixes #3927

2026-06-13 01:36:12 -04:00

ctx.go

fixes #3809 support CSR submission during OIDC authentication (#3840 )