History / Security Profiles and Token Binding

correct five pages against the current code, and document redis-failover - Cookies.md: the four quoted log lines could not be found by anyone grepping for them. oidc_util_set_cookie is oidc_http_set_cookie now, and "cookie value possibly corrupted" and the oidc_crypto_aes_decrypt / EVP_DecryptFinal_ex line no longer exist at all; replaced with the messages the code emits today. - Curity-Identity-Server.md: the manual configuration block omitted OIDCProviderJwksUri, so Apache starts without complaint and the first login fails on ID token signature verification. - Home.md: SetEnv https_proxy does not route the module's own outgoing calls -- it populates the request's CGI environment, not the server process environment libcurl reads -- so OIDCOutgoingProxy is named as the setting that does the work rather than as an addition. - Security-Profiles-and-Token-Binding.md: "a profile is a starting point, not a lock" was wrong for the four settings FAPI20 enforces regardless of configuration (PAR, S256, and the issuer as both authentication audiences). It also understated the reverse: the ID token aud values are overridable, and DPoP stands down to the configured mode for the mTLS variant of the profile. - Caching.md: document the redis-failover backend, the per-server credentials accepted in OIDCRedisCacheServer and OIDCRedisCacheFailbackInterval, none of which appeared anywhere. Chunk-size-0 in Caching.md is left as it stands: the parser now accepts 0, so the page became correct rather than needing a change.

zandbelt committed Aug 8, 2026

doc: document features that shipped without wiki coverage - OAuth 2.0 Resource Server: document OIDCOAuthVerifyAudience and OIDCOAuthVerifyIssuer (2.4.20). The local validation section documented the key material and stopped there, so it described a configuration that accepts any token signed by the configured key - including one the AS issued for a different resource server. Covers the "Require claim aud:<value>" equivalent for older releases, the newly required "exp" claim, and links the advisory GHSA-wcvh-g65p-v576 - Multiple Providers: add the 9 .conf keys the parser accepts but the page never listed: profile, validate_issuer, id_token_aud_values, logout_request_params, token_endpoint_tls_client_cert/_key/_key_pwd, dpop_mode, cert_bound_tokens. The list now matches metadata/conf.c exactly - new page "Security Profiles and Token Binding" covering OIDCProfile (OIDC10/FAPI20), Pushed Authorization Requests, DPoP including the proof API and its local-address restriction, and RFC 8705 mutual TLS client authentication plus certificate-bound access tokens - none of which had a home in the wiki

zandbelt committed Aug 3, 2026