Release v2.48.0

Summary

AuthProxy now keeps sessions and tokens bound to the tenant, and optionally the resource and environment, they were issued for. A person who belongs to several tenants can no longer use a session or token for one tenant to reach another.

Added

• Cratis:AuthProxy:CredentialBinding Resource and Environment settings bind sessions, selection cookies and AuthProxy-issued tokens to the deployment; ones issued for another resource or environment no longer work. Enabling or changing these settings signs everyone out once, so restart all replicas together with identical values (#253)
• EnvironmentClaimType on bearer routes requires exactly one token environment claim matching CredentialBinding:Environment (#253)

Changed

• A request whose session or token is bound to another tenant than the one it addresses is refused with 403 before tenant selection, and nothing is forwarded (#253)
• When tenant selection is configured, a tenant addressed by host, sub-host or route is confirmed against the person's memberships before forwarding; route addressing does not lock the browser to one tenant (#253)
• A selection cookie issued for another resource or environment is discarded and the membership is confirmed again (#253)
• On bearer routes, a token naming another tenant than the host, sub-host or route addresses is refused with 403; Specified and Default tenants do not override the token tenant (#253)
• Starting an ordinary sign-in after an abandoned registration or invitation clears the pending flow instead of failing (#253)
• AuthProxy logs a startup warning when a shared data protection key ring is configured without CredentialBinding:Resource (#253)