Release v2.33.0

AuthProxy can now let a support person, or an agent working for support, signed in as themselves, act on behalf of one user in one tenant for one issue, while the application confirms a live grant for the whole session.

Added

• On-behalf sessions, enabled by the Cratis:AuthProxy:OnBehalf configuration section and off by default. See On-behalf Sessions. (#217)
• POST /.cratis/on-behalf/start, POST /.cratis/on-behalf/end and GET /.cratis/on-behalf to start, end and read the status of a session. Starting requires the actor to pass OnBehalf:ActorAuthorization on top of the deployment's own authorization, and both start and end refuse cross-origin requests.
• A grant check (GET /.cratis/on-behalf/grants) and session started and ended notifications (POST /.cratis/on-behalf/sessions/started and /sessions/ended) that AuthProxy calls on the application. A session starts only on a live grant and an acknowledged start, and the grant is checked again every OnBehalf:RecheckInterval, never past its validUntil or OnBehalf:MaximumLifetime.
• During a session, requests are forwarded as the represented user with the actor in x-cratis-on-behalf-actor and a signed RS256 x-cratis-on-behalf-assertion that binds both identities, the tenant, the session, the issue, and the request's method (htm), path (htu) and service (svc). Signing keys rotate through OnBehalf:Attestation:SigningKeys and ActiveKeyId.
• A session reaches only OnBehalf:Service and the services listed in OnBehalf:Services, stays pinned to the tenant its grant was confirmed for, and ends when it enters an invitation, registration or account link flow.
• AuthProxy validates the OnBehalf section at startup and refuses to start with an unknown service, no actor requirement, unusable signing keys or values out of range.

Security

• Every inbound header starting with x-cratis-on-behalf is removed before forwarding, so a caller cannot name an actor or present an assertion that AuthProxy did not issue for the request.