-
Notifications
You must be signed in to change notification settings - Fork 325
/
ChangeLog
2750 lines (2145 loc) · 96.7 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
09/11/2024
- change warnings about not passing unknown claim types into debug messages; see #1263; thanks @nclarkau
- bump to 2.4.16.4rc1
09/09/2024
- fix accepting custom cookie names in OIDCOAuthAcceptTokenAs cookie:<name>; see #1261; thanks @bbartke
- bump to 2.4.16.4rc0
- improve basic authentication parsing when using OIDCOAuthAcceptTokenAs basic
09/06/2024
- allow overriding globally set OIDCCacheType back to shm in vhosts
- correct typo in child initialization routines when using multiple vhosts; closes #1208; thanks @studersi
this fixes possible segmentation faults when using Redis and Metrics settings in vhosts
- release 2.4.16.3
09/05/2024
- fix OIDCCacheShmMax min/max settings; see #1260; thanks @bbartke
- bump to 2.4.16.3dev
08/30/2024
- release 2.4.16.2
08/29/2024
- fix setting OIDCPKCEMethod none; closes #1256; thanks @eoliphan
08/28/2024
- re-introduce OIDCSessionMaxDuration 0; see #1252
- bump to 2.4.16.2dev
- add some resilience when both Forwarded and X-Forwarded-* are configured
- fix disabled OIDCStateCookiePrefix command; closes #1254; thanks @damisanet
- remove support for OIDCHTMLErrorTemplate, deprecated since 2.4.14
08/26/2024
- fix parsing OIDCXForwardedHeaders; closes #1250; thanks @maltesmann
- release 2.4.16.1
08/23/2024
- release 2.4.16
07/03/2024
- cfg/provider: use oidc_jwk_list_copy when merging client_keys
06/18/2024
- memcache: correct dead server check on APR_NOTFOUND; see #1230; thanks @rpluem-vf
06/08/2024
- support DPoP nonces to the userinfo endpoint
06/07/2024
- return response headers from outgoing HTTP requests to callers
- support DPoP nonces to the token endpoint
06/06/2024
- add OIDCDPoPMode [off|optional|required] primitive
- store the token_type in the session
06/05/2024
- add "nbf" claim in the Request Object as per https://openid.net/specs/openid-financial-api-part-2-1_0-final.html#rfc.section.5.2.2
06/04/2024
- add (client) support for RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP)
- replace multi-provider .conf "issuer_specific_redirect_uri" boolean with "response_require_iss" boolean
- tighten up the "aud" claim validation in ID tokens
- add support for the FAPI 2.0 Security Profile https://openid.net/specs/fapi-2_0-security-profile-ID2.html
05/30/2024
- add support for RFC 9126 OAuth 2.0 Pushed Authorization Requests
04/23/2024
- disable support for the RSA PKCS v1.5 JWE encryption algorithm as it is deemed unsafe
due to the Marvin attack and is removed from libcjose as well
04/05/2024
- add debug printout for OIDCUnAuthAction expression evaluation
04/03/2024
- when an expression is configured for OIDCUnAuthAction (i.e. in the 2nd argument), also apply
it to OIDCUnAutzAction so that it can be used to enable step-up authentication for SPAs with
non-conformant browsers (some versions of Safari) and in (potentially insecure) iframes
see #1205; thanks @ryanwilliamnicholls
04/02/2024
- major rewrite of config primitive handling:
- split out over different files, use header files consistently
- encapsulate config record with getters/setters
- allow overriding defined global configuration primitives to their default value on the individual vhost level
- apply input/boundary checking on all configuration values, shared with provider metadata parsing
- various fixes to applying default config values and allowing primitives in vhost/directory scopes
- return HTTTP 502 when refreshing acces token or userinfo fails (default: "502_on_error")
- use a singleton token refresh mutex
- add support for OIDCOAuthIntrospectionEndpointKeyPassword
- bump to 2.4.16dev
04/01/2024
- release 2.4.15.7
03/29/2024
- fix OIDCUserInfoRefreshInterval, interval seconds would be interpreted as microseconds
03/14/2024
- fix userinfo refresh interval parsing; closes #1200; thanks @HolgerHees
avoid refreshing userinfo on each request until access token expiry
- store interval as JSON integer in session
- use SameSite=Lax when OIDCCookieSameSite is On (also by default) instead of
Strict as overriding from Lax to Strict does not work reliably anymore (Chrome)
- release 2.4.15.6
03/13/2024
- fix compilation without libhiredis; closes #1195 ; thanks @HolgerHees
conditionally define oidc_set_redis_connect_timeout
- fix `OIDCPassClaimsAs environment` bug introduced in 2.4.15.4; see #1196; thanks @HolgerHees
- release 2.4.15.5
03/12/2024
- release 2.4.15.4
- fix setting the default PCKE method to "none" in a multi-provider setup
- bump to 2.4.15.5dev
03/11/2024
- avoid warning about setting a self-provided default value in the provider config
03/07/2024
- OIDCProviderSignedJwksUri: accept verification key set formatted as either JWK or JWKS
see #1191; thanks @psteniusubi
- properly handle parse errors in Require claim integer statements
03/06/2024
- add support for JSON real and null value matching in Require claim statements
- fix evaluation Require statements for nested array claims
- refactor handle/authz.c
03/04/2024
- refactor integer and timestamp handling
- fix default HTTP short retry interval setting
- accept 0 in OIDCUserInfoRefreshInterval
- userinfo refresh: don't try to refresh the access token and retry when a connectivity error has occurred
- logout: don't try to revoke tokens on post-access-token-refresh or post-userinfo-refresh-errors logouts
03/01/2024
- accept strings as well as integers in the "expires_in" claim from the token endpoint
- fix for "expires_in" string values returned from the token endpoint that would be interpreted as 0
this fixes using OIDCRefreshAccessTokenBeforeExpiry or OIDCUserInfoRefreshInterval with (older)
Azure AD configs that would result in a token refresh on every request since 2.4.15 or a 401 in 2.4.14.4
- fix setting the "exp" claim in userinfo signed JWTs (exp would be now+0) when no expires_in is returned
by the OP
- fix signed JWT caching when ttl set to 0 or "" which should apply the exp claim as the cache ttl
02/29/2024
- hash the cache key if it is larger than 512 bytes so large cache key entries (i.e. for JWT tokens)
are no longer a problem in unencrypted SHM cache configs, i.e. the default shared memory cache setup;
see issues/discussions on "could not construct cache key since key size is too large"
this is relevant for OAuth 2.0 RS configs with JWT access tokens and OpenID Connect RP
configs where OIDCRefreshAccessTokenBeforeExpiry/OIDCUserInfoRefreshInterval is set and
a JWT refresh token is returned
- fix debug printout of cache key in oidc_cache_get
02/28/2024
- optimize performance by skipping JSON processing when `OIDCPassClaimsAs none` is set
02/25/2024
- implement oidc_util_apr_hash_clear so clearing hashtables works with older versions of libapr
- refactor/extract HTTP functions
02/22/2024
- enable TCP keepalive on Redis connections by default
and make it configurable in `OIDCRedisCacheConnectTimeout <connect-timeout> [0|<keep-alive-interval>]`
- refactor Redis connect routines
02/21/2024
- OIDCProviderSignedJwksUri: make exp claim optional in signed jwks; see #1182; thanks @psteniusubi
interop with OpenID Federation specification https://openid.net/specs/openid-federation-1_0-32.html#section-5.2.1
02/15/2024
- refactor zlib compression routines and add error checks
- bump to 2.4.15.4dev
02/13/2024
- release 2.4.15.3
02/12/2024
- set Redis default retry interval time to 300 milliseconds (instead of 0.5ms) and make it configurable
- rewrite handling of parallel refresh token grant requests
- temporarily cache the results of the refresh token grant for other (almost) parallel callers
- fixes handing on the same server, and improves clustered handling through a best-effort distributed cached lock
- improves handling of non-rollover refresh tokens since it avoids unnecessary repeated calls to
the token endpoint, unnecessary token issuance and possibly corruption because different tokens "live"
temporarily in the same (conceptual) session in parallel before the session is stored (and the last one wins)
- bump to 2.4.15.3dev
02/06/2024
- CVE-2024-24814: prevent DoS when `OIDCSessionType client-cookie` is set and a crafted Cookie header is supplied
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
- release 2.4.15.2
01/31/2024
- avoid crash when Forwarded is not present but OIDCXForwardedHeaders is configured for it; see #1171; thanks @daviddpd
- bump to 2.4.15.2dev
01/30/2024
- release 2.4.15.1
01/22/2024
- refactor metrics and fix Prometheus output overlap; closes #1161; see #1162 and #1160; thanks @studersi
- bump to 2.4.15.1rc0
01/17/2024
- use `apr_file_rename` in file cache backend to fix issue with renaming files on windows
01/09/2024
- release 2.4.15
12/29/2023
- fix Redis connnect retries and make it configurable through environment variable OIDC_REDIS_MAX_TRIES
- bump to 2.4.15rc14
12/28/2023
- set memory alignment of shm cache structs to 64 bytes; see #1067
should fix running on Raspberry PI / ARMv7 32 bits (arm32v7)
- make sure the shm cache entry size is a multiple of 8 bytes, see #1067; thanks @sanzinger
- bump to 2.4.15rc13
12/22/2023
- generate 20-byte lowercase hexadecimal session identifiers
12/20/2023
- generate or propagate traceparent header using OIDCTraceParent; closes #1152; thanks @studersi
- include hostname,port and process id in User-Agent header on outgoing requests
- bump to 2.4.15rc12
12/19/2023
- metrics update:
- rename "requests" class to "provider"
- don't include label name in metric name
- add HTTP response code and connectivity counters
- reset counters in shared memory rather than removing
- performance
- bump to 2.4.15rc11
12/18/2023
- metrics refactoring and extension
- bump to 2.4.15rc10
12/15/2023
- add (and fix) more metrics, including provider requests, authorization and cache
- bump to 2.4.15rc9
12/14/2023
- add metrics collection capability, configured with OIDCMetricsData and retrieved through OIDCMetricsPublish
- bump to 2.4.15rc8
11/30/2023
- fix SSL server certificate validation when revoking tokens
apply `OIDCSSLValidateServer` setting rather than `OIDCOAuthSSLValidateServer` in `oidc_revoke_tokens`
see https://github.com/OpenIDC/mod_auth_openidc/discussions/1141; thanks @mschmidt72
- bump to 2.4.15rc7
11/27/2023
- use clang-format-17 for code formatting and reformat all code
11/23/2023
- add iat and exp claims to request object; closes #1137
- bump to 2.4.15rc6
11/22/2023
- populate User-Agent header in outgoing HTTP requests with mod_auth_openidc, libcurl and OpenSSL
version information and log it for debugging purposes
- bump to 2.4.15rc5
11/08/2023
- improve error message in case of curl timeouts
- bump to 2.4.15rc4
11/02/2023
- apply ISO-8859-1 ("latin1") as default encoding mechanism for claim values passed in headers and environment
variables to comply with https://www.rfc-editor.org/rfc/rfc5987; see #957; use "OIDCPassClaimsAs <any> none"
for backwards compatibility
- bump to 2.4.15rc3
11/01/2023
- avoid warnings on cache misses (regression introduced in 2.4.15rc1)
- bump to 2.4.15rc2
10/31/2023
- add capability to seamlessly rollover OIDCCryptoPassphrase using a (temporary) 2nd value that holds the old one
- bump to 2.4.15rc1
- remove obsolete support for Token Binding https://www.rfc-editor.org/rfc/rfc8471.html (id_token, access_token, session cookie)
- use only the User-Agent header as input for the state browser fingerprinting by default (no X-Forwarded-For)
as cloud environments increasingly use dynamic proxy IPs in front
- use PKCE S256 by default; disable by configuring "OIDCPKCEMethod none"
- use SameSite cookies Strict by default; disable by configuring "OIDCCookieSameSite Off"
10/30/2023
- do not apply logout_on_error and authenticate_on_error when a parallel refresh token request is detected
see https://github.com/OpenIDC/mod_auth_openidc/discussions/1132; thanks @esunke
- restore backwards compatibility wrt. allowing parallel refresh token requests by default, and add an
option to prevent that (i.e. in case of rolling refresh tokens) using envvar OIDC_PARALLEL_REFRESH_NOT_ALLOWED
- return HTTP 500 on token refresh errors instead of HTTP 401
- retry failed outgoing HTTP requests and add options to configure it in OIDCHTTPTimeoutLong/OIDCHTTPTimeoutShort
- bump to 2.4.15rc0
10/12/2023
- release 2.4.14.4
10/11/2023
- improve behaviour when parallel refresh token grant requests occur on the same Apache server/host
and rolling refresh tokens are issued; synchronize using a global refresh token lock and avoid
corrupting the session by storing/overwriting an expired refresh token
- bump to 2.4.14.4rc6
09/22/2023
- performance: store userinfo refresh interval in session to avoid parsing JSON on each request
- fix memory leak in oidc_refresh_token_grant: free the parsed id_token that is returned
- bump to 2.4.14.4rc5
09/20/2023
- performance: skip re-validating cached provider metadata
- performance: use process based locking instead of global locking for Redis caching
- avoid potential process lifetime memory leak when mutex lock/unlock fails
09/19/2023
- fix performance issue with latin1 encoding when using OIDCPassClaimsAs <any> latin1
- add options for authentication to OIDCOutgoingProxy; thanks @drzraf
see https://github.com/OpenIDC/mod_auth_openidc/discussions/1107
- add support for custom preserve/restore POST data templates with OIDCPreservePostTemplates
to be used when OIDCPreservePost is set to On; the hard-coded internal templates are added to
the test directory as an example; closes #195 (yeah...); thanks @kerrermanisNL and @spiazzi
- bump to 2.4.14.4rc3
09/14/2023
- fix `OIDCRefreshAccessTokenBeforeExpiry` when using it with `logout_on_error` or `authenticate_on_error`
see #1111; thanks @brandonk10
- bump to 2.4.14.4rc0
09/05/2023
- release 2.4.14.3
08/25/2023
- add support for adding extra parameters to the Logout Request to the OP with OIDCLogoutRequestParams
see: https://github.com/OpenIDC/mod_auth_openidc/discussions/1096
- bump to 2.4.14.3rc7
08/13/2023
- increase performance of JQ filtering by caching JQ filtering results
default cache ttl is 10 min, configured through environment variable OIDC_JQ_FILTER_CACHE_TTL
- bump to 2.4.14.3rc5
07/25/2023
- support "authenticate_on_error" 2nd parameter value in OIDCRefreshAccessTokenBeforeExpiry
to reauthenticate the user when refreshing the access token fails
see: https://github.com/OpenIDC/mod_auth_openidc/discussions/1084; thanks @xrammit
- add logout_on_error and authenticate_on_error 2nd parameter option to OIDCUserInfoRefreshInterval
- bump to 2.4.14.3rc4
07/18/2023
- allow relative values in OIDCDefaultURL and OIDCDefaultLoggedOutURL
- bump to 2.4.14.3rc3
07/14/2023
- fix session updates on userinfo requests; see https://github.com/OpenIDC/mod_auth_openidc/discussions/1077
this bug was introduced in v2.4.11 with d9fff154ee6ee8a7e4e969dd6a68cbaf18354598
- bump to 2.4.14.3rc2
07/12/2023
- add a sanity alg/enc check on self-encrypted AES GCM JWTs
- add `OIDCPassAccessToken Off` option to disable (the default of) passing the access token and its expiry
in the OIDC_access_token/OIDC_access_token_expires header/environment variables; thanks @mattias-asander
- bump to 2.4.14.3rc1
06/05/2023
- avoid using encryption keys as signing keys for request objects and private_key_jwt token endpoint auth
- log the first Redis error as a warning before retrying
- release 2.4.14.2
05/30/2023
- revert all 401/403/302/stepup behaviour to <= 2.4.13.2
- bump to 2.4.14.2rc1
05/25/2023
- add support for extend_session=false query parameter to the info hook
to avoid extending the session on calls to the info hook
- bump to 2.4.14.2rc0
05/24/2023
- fix RequireAny behaviour on 401/403/302: revert 9d6192b2ab0716d8f7d2a29754a80b6ab1e804eb for non-stepup authentication cases
- make OIDCUnautzAction 302|auth (i.e. step up authentication) work with multiple/complex Require expressions e.g. RequireAny
- release 2.4.14.1
05/17/2023
- fix refreshing claims from the userinfo endpoint when no id_token claims are stored in the session
- fix memory leak when refreshing claims from the userinfo endpoint
- bump to 2.4.14.1rc0
- fix docs on OIDCUnAutzAction 403 in auth_openidc.conf because we no longer rely on Apache 2.4's AuthzSendForbiddenOnFailure On to return 403
05/15/2023
- release 2.4.14
05/05/2023
- add exec support to OIDCClientSecret; see #1056; thanks @sealor
05/04/2023
- cater for libapr/libapr-util version 1.2.x
- bump to 2.4.14rc13
04/27/2023
- increase default OIDCCacheShmMax to 10000
04/25/2023
- add options to avoid revoking tokens before logout
as some OPs may kill their SSO session that would make subsequent logout fail;
configure an empty string in OIDCProviderRevocationEndpoint or set the
OIDC_DONT_REVOKE_TOKENS_BEFORE_LOGOUT environment variable
- bump to 2.4.14rc12
04/24/2023
- preserve linefeeds in text areas with OIDCPreservePost On
by changing the order of the "type=hidden" in the restore Javascript page
see: https://github.com/OpenIDC/mod_auth_openidc/discussions/717
thanks @paulQdata and @jansmets
04/23/2023
- add environment variable OIDC_DONT_STORE_ID_TOKEN_CLAIMS_IN_SESSION option to not store
the claims in the id_token in the session, to avoid storing claims that are not used anyway
and/or overlap with userinfo claims
- bump to 2.4.14rc11
04/21/2023
- use compressed serialized JSON for encrypted cache entries instead of signed JWTs, reducing cache entry size
- refactor (internal) encrypted JWTs handling
- remove support for obsoleted internal signed JWTs
- add resilience for corrupted metadata and jwks_uri cache entries
04/20/2023
- allow defining OIDCPassIDTokenAs on a per-location/directory level; also fixes resetting back to "claims" in vhosts
- turn of caching by default for `OIDCPassUserInfoAs signed_jwt`
- use compressed serialized JSON for encrypted state and session cookies, reducing their size; thanks @hihellobolke
- bump to 2.4.14rc10
04/19/2023
- add support for using Elliptic Curve keys with `OIDCPassUserInfoAs signed_jwt`
- bump to 2.4.14rc9
04/18/2023
- support calling the refresh token grant before doing RP-initiated logout
when the environment variable OIDC_REFRESH_TOKENS_BEFORE_LOGOUT is set
may be used to supply a (fresh or non-cached) id_token_hint logout request parameter
- add support for returning the serialized id_token as id_token_hint from the info hook
- fix crash when using a multi-provider setup and Provider has signed_jwks_uri set but
the conf file does not define signed_jwks_uri_key
- correct return value from oidc_cache_shm_destroy to avoid misleading
"cache destroy function failed" error messages
- bump to 2.4.14rc8
04/16/2023
- OIDCUnAutzAction auth for stepup authentication now immediately returns a 302 instead
of a 200 HTML page with a meta refresh tag and a Location header
- also fix OIDCUnAutzAction 403 so it does not rely on AuthzSendForbiddenOnFailure
- bump to 2.4.14rc7
04/13/2023
- fix session cookie decompression error with OIDCSessionType client-cookie; closes #1046; thanks @oss-aimoto
this would occur when the uncompressed JWT is larger than 4 times the compressed JWT
oidc_util_jwt_verify: parsing JWT failed: [src/jose.c:901: oidc_jose_zlib_uncompress]: inflate failed
oidc_session_decode: could not verify secure JWT: cache value possibly corrupted
https://github.com/OpenIDC/mod_auth_openidc/pull/1047
- add option to strip the AES GCM header from encrypted state/session JWTs with env var OIDC_JWT_STRIP_HDR=true
- bump to 2.4.14rc6
04/11/2023
- add caching of signed userinfo JWTs; default cache time is set to the "exp" claim, can be configured/disabled with:
SetEnvIfExpr true "OIDC_USERINFO_SIGNED_JWT_CACHE_TTL=0"
be careful when setting "jti", "nbf", "iat" and" "exp" claims in the OIDCUserInfoClaimsExpr filter since they may
overload the cache with entries per-user/per-timestamp if the result differs from the previous request
- bump to 2.4.14rc5
04/11/2023
- add OIDCFilterClaimsExpr that allows for processing claims in the both the id_token and claims from the
userinfo endpoint before storing them in the session, after applying (optional) blacklisting/whitelisting
on the toplevel keys; only available when compiled/linked with libjq
- fix memory access error using default value for OIDCPassUserInfoAs
- bump to 2.4.14rc4
04/10/2023
- add support for OIDCUserInfoClaimsExpr that allows for processing claims returned from the userinfo
endpoint with a JQ-based expression before propagating them according to OIDCPassUserInfoAs claims|json|signed_jwt
(ie. does not work for "OIDCPassUserInfoAs jwt"), and is only available when compiled/linked with libjq
- allow OIDCPassUserInfoAs directive in Location/Directory contexts
- fix memory leak when using JQ-based expressions in "Require claims_expr"
- bump to 2.4.14rc3
04/09/2023
- make sure mod_auth_openidc runs before mod_proxy so calls to the redirect URI are never proxied
and no separate Location directive or ProxyPass exception for OIDCRedirectURI is required (anymore)
- handle discovery in the content handler so regular Apache processing applies to the HTTP/HTML response
- bump to 2.4.14rc2
04/09/2023
- return 40x instead of 200 on all (authorization) error responses
- correct backwards compatibility with <2.4.14 for state mismatch/timeout handling
- bump to 2.4.14rc1
04/07/2023
- deprecate OIDCHTMLErrorTemplate and rely on standard Apache error handling capabilities by default
environment variable strings REDIRECT_OIDC_ERROR and REDIRECT_OIDC_ERROR_DESC are available in ErrorDocument
backwards compatibility is retained by setting "OIDCHTMLErrorTemplate deprecated"
- bump to 2.4.14rc0
04/07/2023
- add support for passing on claims resolved from the userinfo endpoint in a JWT signed by
mod_auth_openidc using `OIDCPassUserInfoAs signed_jwt[:<name>]` with the keys configured
in OIDCPrivateKeyFiles/OIDCPublicKeyFiles
- add support for overriding the default header/environment variable names in
`OIDCPassUserInfoAs json:<name>` (default: "OIDC_userinfo_json")
and
`OIDCPassUserInfoAs jwt:<name>` (default: "OIDC_userinfo_jwt")
- bump to 2.4.13.3rc3
04/06/2023
- merge client_signing_keys and client_encryption_keys into client_keys
since we detect the usage type correctly now
- bump to 2.4.13.3rc2
04/04/2023
- support configuration of dedicated signing and encryption keys in the primitives:
OIDCPublicKeyFiles, OIDCPrivateKeyFiles, OIDCProviderVerifyCertFiles, OIDCOAuthVerifySharedKeys and OIDCOAuthVerifyCertFiles
by using the prefix "sig:" or "enc:" in the value; using this in OIDCPublicKeyFiles also
publishes separate "use: sig" and/or "use: enc" keys on the client jwks_uri <redirect_uri>?jwks=rsa
- fix: don't immediately refresh of JWKs from (signed)_jwks_uri if "kid" was not set in JWT, but try the cache first
- fix: properly respect "use" attribute (sig/enc) in signing, verification and encryption
- bump to 2.4.13.3rc1
04/03/2023
- generate Elliptic Curve "kid" using curve identifier with htonl in network byte order
so "make check" works on big endian platforms
- include openssl/err.h in config.c to avoid compiler warning with OpenSSL 1.0.x
- bump to 2.4.13.3rc0
04/03/2023
- release 2.4.13.2
04/01/2023
- allow target_link_uri's without a path in 3rd-party-init SSO with a multi-provider setup
- correct error log in target_link_uri matching
03/28/2023
- CVE-2023-28625: prevent core dump when OIDCStripCookies is set and a crafted Cookie header is supplied
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr
- replace apr_strnatcmp/strcmp with _oidc_strcmp and replace strncmp with _oidc_strncmp
- handle OpenSSL initialization in new oidc_pre_config_init function:
this allows omitting "kid" in OIDCPublicKeyFiles (ao.) when linked against OpenSSL 1.0.x
03/27/2023
- fix code scanning alerts
- bump to 2.4.13.2rc2
03/24/2023
- add support for Elliptic Curve signing/encryption keys in addtion to RSA keys,
i.e. client keys configured in OIDCPrivateKeyFiles/OIDCPublicKeyFiles, published on OIDCClientJwksUri
and used in private_key_jwt authentication, encrypted id_token's, request objects/uri's,
but also statically configured provider keys in OIDCOAuthVerifyCertFiles and OIDCProviderVerifyCertFiles
- refactor Docker tests make targets; add test/Makefile
- bump to 2.4.13.2rc1
03/24/2023
- record authorization errors in environment variable OIDC_AUTHZ_ERROR
so its value can be used in logs e.g. with HTTP 401 responses:
LogFormat "%h %l %u %t %U %401{OIDC_AUTHZ_ERROR}e %>s %b" combined
- log authorization errors with oidc_debug instead of oidc_info
- bump to 2.4.13.2rc0
03/10/2023
- fix oidc_jwk_list_copy and usage of OIDCProviderVerifyCertFiles
- release 2.4.13.1
03/10/2023
- shm cache: increase default maximum number of active sessions from 500 to 2000
- shm cache: allow configuration of max 1Mb of session data for a single session
- use deep-copy and cleanup functions for server and provider configs; fixes overriding server-level keys in vhost configs
- release 2.4.13
03/09/2023
- add support for OP "signed_jwks_uri" with "OIDCProviderSignedJwksUri <uri> <jwk>"
- don't pull JWKs when the id_token was signed with a symmetric key
- don't immediately refresh of JWKs from (signed)_jwks_uri if "kid" was not set in JWT, but try the cache first
- warn about incorrect configurations not setting OIDCCryptoPassphrase; see https://github.com/OpenIDC/mod_auth_openidc/discussions/1030
- bump to 2.4.13rc5
03/08/2023
- move repo to OpenIDC github organization
03/02/2023
- allow setting minumum and maximum versions of TLS used in HTTPs calls via libcurl environment
variable CURLOPT_SSL_OPTIONS e.g.:
SetEnvIfExpr true "CURLOPT_SSL_OPTIONS=CURL_SSLVERSION_TLSv1_3 CURL_SSLVERSION_MAX_TLSv1_3" ; bump to 2.4.13rc3
- bump to 2.4.13rc3
03/01/2023
- revert accidentally removed libbrotli code in jose.c
- bump to 2.4.13rc2
02/19/2023
- add optional - compilation time support - for brotli compression of session and state cookies
02/17/2023
- avoid (small) memory leak when using OpenSSL 3.x when setting public/private keys
(over graceful restarts) in the config and/or importing JWKs with x5c specs
- compress session and state cookies; add zlib as a dependency
- bump to 2.4.13rc0
01/27/2023
- increase maximum allowed size of HTTP responses (e.g. from token endpoint) to 10Mb; see #998; thanks @mikehearn
- do a sanity check on the individual size of claim values stored in the session, warn about blacklisting if > 8Kb
- bump to 2.4.12.4rc2
01/23/2023
- release 2.4.12.3
01/20/2023
- add OIDCProviderVerifyCertFiles option to statically configure ID token validation keys; see #989; thanks @madsfreek
- fix bug in OIDCOAuthVerifyCertFiles where cert(s) would be cast to apr_hash_t instead of apr_array_header_t; see #990; thanks @bommo1
- bump to 2.4.12.3rc0
12/28/2022
- update sample/test Dockerfile to Ubuntu Jammy
12/13/2022
- CVE-2022-23527: prevent open redirect in default setup when OIDCRedirectURLsAllowed is not configured
see: https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53
- release 2.4.12.2
12/08/2022
- simplify redis context code
- bump to 2.4.12.2rc1
11/18/2022
- allow overriding the type of lock used at compile time with OIDC_LOCK
- bump to 2.4.12.2rc0
11/15/2022
- release 2.4.12.1
11/13/2022
- switch to using apr_generate_random_bytes instead of apr_uuid_get to generate session identifiers
so there's no longer a (rather implicit) dependency on a libapr that is compiled againt libuuid
on Linux platforms; see #431, #603 and #694; thanks @amitnarang28
- cache file backend fix: delete the correct file upon logout; closes #955; thanks @damisanet
- bump to 2.4.12.1rc5
11/08/2022
- add option to use ISO-8859-1 encoding for propagated claim values by adding
"latin1" option to OIDCPassClaimsAs <> latin1; see #957; thanks @nvchaudhari1991
Note that the encoding - including the existing "base64url" - apply to both header and
environment variables as well now.
- bump to 2.4.12.1rc4
10/26/2022
- OIDCProviderMetadataRefreshInterval was interpreted in microseconds instead
of the documented and intended seconds; setting in to seconds would effectively
turn of caching and pull the configuration document on each request
- bump to 2.4.12.1rc3
10/25/2022
- define APLOG_TRACE1 if it does not exist
- bump to 2.4.12.1rc2
10/20/2022
- CI: add memory and semaphore checks on various distro's
- correct ap_hook_insert_filter function signature in stub.c, part 3; see #784
- fix printout of cache mutex errors in cache/common.c
- prefer APR_LOCK_POSIXSEM over APR_LOCK_DEFAULT in apr_global_mutex_create
which is apparently required for (some) ARM based builds (and CI)
- bump to 2.4.12.1rc1
- fix potential memory leak in proto.c when oidc_util_create_symmetric_key fails
- fix potential memory leak in proto.c when oidc_proto_validate_access_token fails (at_hash validation)
10/19/2022
- fix cleanup of semaphores on graceful restarts; see #522, closes #458
simplify mutex/shm cleanup without semaphores because we track the parent process anyway;
- bump to 2.4.12.1rc0
10/17/2022
- release 2.4.12
10/15/2022
- add option to set a username for Redis authentication via OIDCRedisCacheUsername
- bump to 2.4.11.4rc7
10/14/2022
- set minimum number of default memcache threads to 0 to retain backwards compatibility
see #916
- support OIDCSessionInactivityTimeout values greater than 30 days when using Memcache
see #936, thanks @takesson
- bump to 2.4.11.4rc6
10/03/2022
- add -fPIC to test and test-cmd compilation; see #925
- bump to 2.4.11.4rc5
09/23/2022
- allow for step-up discovery with an external URL using HTML refresh
fixes behaviour on CentOS 7/8 when combined with ProxyPass
- bump to 2.4.11.4rc4
09/12/2022
- add options to retrieve the configuration document only or pull keys from the JWKS URI;
for certification purposes
- check ID token signed response algorithm on backchannel logout_token and retrieve its
configuration value from the client metadata file; for certification purposes
- register request_object_signing_alg in dynamic client registration when using request_uri;
for certification purposes
- bump to 2.4.11.4rc3
09/08/2022
- store access token obtained from backchannel in session over the one returned
in the frontchannel for "code token" and "code id_token token" flows; for
certification purposes
- apply exact length matching for at_hash and c_hash validation; for certification purposes
- increase size of the output buffer when using libpcre2 for substitution; closes #915
- bump to 2.4.11.4rc2
- allow setting connection pool parameters for Memcache server connections;
see #916; thanks @rpluem-vf
08/24/2022
- avoid using $< in Makefile
- allow storing the id_token in a client-cookie based session; see #812 and #888
- bump to 2.4.11.4rc1
08/22/2022
- add oidc_util_strcasestr
- bump to 2.4.11.4rc0
08/22/2022
- release 2.4.11.3
08/15/2022
- avoid memory leak when using PCRE2 regular expressions with array matching; closes #902; thanks @smanolache
- avoid memory leak when cjose_jws_get_plaintext fails; closes #903; thanks @smanolache
- bump to 2.4.11.3rc4
05/20/2022
- fix handling of IPv6 based logout URLs; thanks @@codemaker219
- bump to 2.4.11.3rc1
05/16/2022
- Use optionally provided sid and iss request parameters during front channel
logout; see #855; thanks @rpluem-vf
05/06/2022
- support Forwarded header in addition to X-Forwarded-*; see #853; thanks @studersi
- bump to 2.4.11.3rc0
05/05/2022
- release 2.4.11.2
05/04/2022
- add support for Apache expressions in OIDCPathAuthRequestParams and OIDCPathScope; see #594
- bump to 2.4.11.2rc2
04/22/2022
- add no Cache-Control headers to logout request response; see #846; thanks @blackwhiser1
- bump to 2.4.11.2rc1
04/06/2022
- don't strip the header from encrypted JWTs as future versions of cjose may use compact
encoding for JWEs; this slightly increases state cookie size, by-value session cookies
and encrypted cache contents again at the benefit of forward cjose compatibility
- bump to 2.4.11.2rc0
03/29/2022
- release 2.4.11.1
03/28/2022
- correct registration_endpoint_json naming in auth_openidc.conf documentation
03/21/2022
- fix OIDCUnAuthAction pass, see #790
- bump to 2.4.11.1rc5
03/18/2022
- fix make check; add @smanolache to the AUTHORS file
- bump to 2.4.11.1rc4
03/17/2022
- fix memory leaks over graceful restarts: use s->process->pconf pool instead of
the s->process->pool in oidc_slog and oidc_cache_shm_cfg_create
closes #823 and #824; thanks @smanolache
03/14/2022
- fix temporary cache file naming; see #777
03/08/2022
- fix a 2nd race condition in the file cache backend; see #777; thanks @dbakker and @blackwhiser1
- bump to 2.4.11.1rc3
03/04/2022
- add support for OpenSSL 3.0
- remove test-cmd jwk2cert command
- bump to 2.4.11.1rc2
02/28/2022
- add a check to make sure URLs do not contain unencoded Unicode characters; see #796; thanks @cnico
- bump to 2.4.11.1rc1
02/27/2022
- document Apache 2.4 behavior on OIDCUnAutzAction 403; see #795; thanks @candlerb
02/04/2022
- correct ap_hook_insert_filter function signature in stub.c, part 2; closes #784; thanks @stroeder
02/03/2022
- add Valgrind Github action
- warn about mismatch between incoming X-Forwarded-* headers and OIDCXForwardedHeaders configuration
- avoid using %llu print formatter and switch to %lu for unsigned long so it works cross platform
- bump to 2.4.11.1rc0
01/26/2022
- improve handling session duration expiry when combined with OIDCUnAuthAction or Discovery
also clear r->user in oidc_session_kill for such cases; see #778
- release 2.4.11
01/24/2022
- fix race condition in file cache backend reading truncated files under load; see #777; thanks @dbakker
- bump to 2.4.11rc7
01/23/2022
- fix regular expressions in Require statements
- bump to 2.4.11rc6
01/22/2022
- no longer defer Discovery to the content handler to allow RequireAll and Require not directives
see #770; closes #775; thanks @rajeevn1
- bump to 2.4.11rc5
01/17/2022
- terminate on startup when the crypto passphrase generated by "exec:" is empty; see #767
- bump to 2.4.11rc4
01/15/2022
- correct printout of session id and remote user tuple for new sessions
- avoid debug printout of payload as header when the latter is stripped
01/14/2022
- fix: avoid crash when using pcre2 for claims matching: don't pass NULL for errorstr
- add administrative session revocation capability <redirect_uri>?revoke_session=<uuid>
- bump to 2.4.11rc3
01/12/2022
- add AM_PROG_CC_C_O to configure.ac (at least for RHEL 7.7); see #765; thanks @bitmagewb
- include <openssl/bn.h> in jose.c to compile with OpenSSL 1.0.x
- fix parameters to get_current_url in oidc_handle_unauthorized_user22
- bump to 2.4.11rc2
01/06/2022
- improve detection of suspicious redirect URLs; add test list
- bump to 2.4.11rc1
12/24/2021
- make interpretation of X-Forwarded-* headers configurable, defaulting to none
so mod_auth_openidc running behind a reverse proxy that sets X-Forwarded-* headers
needs explicit configuration of OIDCXForwardedHeaders
- bump to 2.4.11rc0
12/21/2021
- add "x5t" to JWT header in private_key_jwt client assertions; for interop with Azure AD
- add CI Github workflow over Travis
- bump to 2.4.10.1rc4
12/16/2021
- make X-Frame-Options header returned on OIDC front-channel logout requests configurable
through OIDCLogoutXFrameOptions; closes #464
- bump to 2.4.10.1rc3
12/15/2021
- remove typedef for oidc_pcre to avoid compiler errors
12/02/2021
- add support for libpcre2; see #740
- bump to 2.4.10.1rc2
12/01/2021
- allow authorization on info requests, see #746
- bump to 2.4.10rc1
11/28/2021
- install taking into account DESTDIR; see #674; thanks @alerque
11/11/2021
- correct ap_hook_insert_filter function signature in stub.c; closes #732; thanks @stroeder
- bump to 2.4.10.1rc0
11/10/2021
- release 2.4.10
11/03/2021
- add redirect/text options to OIDCUnAutzAction; see #715; thanks @chrisinmtown
- bump to 2.4.10rc1
11/02/2021
- add check for Sec-Fetch-Dest header != "document" value to auto-detect requests that are not
capable of handling an authentication round trip to the Provider;
see https://github.com/zmartzone/mod_auth_openidc/discussions/714; thanks @studersi
- bump to 2.4.10rc0
10/28/2021
- use apxs to link the module in Makefile.am
- bump to 2.4.9.5rc8
10/27/2021
- fix regexp substition crash using OIDCRemoteUserClaim; thanks @nneul; closes #720
- backport ap_get_exec_line, supporting the "exec:" option in OIDCCryptoPassphrase
- add check for Sec-Fetch-Mode header != "navigate" value to auto-detect XML HTTP Requests
- bump to 2.4.9.5rc7
10/22/2021
- complete usage of autoconf/automake; see #674
- bump to 2.4.9.5rc4
10/20/2021
- fix parallel builds (on Debian) for now
- bump to 2.4.9.5rc1
10/19/2021
- log require claims failure on info level
- bump to 2.4.9.5rc0
09/09/2021
- fix memory leak when parsing JWT access token fails (in RS mode)
09/07/2021
- reorganize Redis code for extensibility
09/03/2021
- return HTTP 200 for OPTIONS requests in auth-openidc mixed mode
- don't apply claims based authorization for OPTIONS requests
so paths protected with Require claim directives will now also
return HTTP 200 for OPTIONS requests
- fix typo in 2.2 authorization routine
09/03/2021
- don't apply authz in discovery process; fixes 2.4.9.3
- apply OIDCRedirectURLsAllowed setting to target_link_uri; closes #672; thanks @Meheni
- release 2.4.9.4
08/26/2021
- don't apply authz to the redirect URI; fixes ac5686495a51bc93e257e42bfdc9c9c46252feb1
- bump to 2.4.9.3
08/20/2021
- fix graceful restart (regression); see #458; thanks @Foxite
- bump to 2.4.9.2
08/18/2021
- preserve session cookie in the event of a cache backend failure
- update the id_token in the session cache if one is provided while refreshing the access token
08/13/2021
- fix retried Redis commands after a reconnect; thanks @iainh
- release 2.4.9.1
07/22/2021
- use redisvCommand to avoid crash with crafted key when using Redis without encryption; thanks @thomas-chauchefoin-sonarsource
- replace potentially harmful backslashes with forward slashes when validating redirection URLs; thanks @thomas-chauchefoin-sonarsource
- release 2.4.9
- don't use DEFAULT_LIMIT_REQUEST_LINE constant; since it does not exist in Apache 2.2.x
07/15/2021
- verify that "alg" is not none in logout_token explicitly
- make session not found on backchannel logout produce a log warning instead of error
- don't clear POST params authn on token revocation; thanks @iainh
- bump to 2.4.9rc0
07/02/2021
- handle discovery in the content handler
- return OK in the content handler for calls to the redirect URI and when preserving POST data
06/25/2021
- avoid XSS vulnerability when using OIDCPreservePost On and supplying URLs that contain single quotes
thanks @oss-aimoto
06/21/2021
- strip A256GCM JWT header from encrypted JWTS used for state cookies, cache encryption and by-value session cookies
resulting in smaller cookies and reduced cache content size
06/10/2021
- use encrypted JWTs for storing encrypted cache contents and avoid using static AAD/IV; thanks @niebardzo
- bump to 2.4.9-dev
06/04/2021
- fix a problem where the host and port are calculated incorrectly, when you use literal ipv6 address.
06/02/2021
- do not send state timeout HTML document when OIDCDefaultURL is set; this can be overridden by using e.g.:
SetEnvIfExpr true OIDC_NO_DEFAULT_URL_ON_STATE_TIMEOUT=true
- release 2.4.8.4
06/01/2021
- avoid Apache 2.4 appending 400/302(200/404) HTML document text to state timeout HTML info page
see also f5959d767b0eec4856d561cbaa6d2262a52da551 and #484; at least Debian Buster was affected
- release 2.4.8.3
05/18/2021