Skip to content

v0.3.0

Choose a tag to compare

View all tags
@chris-dare chris-dare released this 13 Jun 18:35
v0.3.0
3551380
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Per-user downstream auth via OAuth token exchange (RFC 8693)

Connectors can now authenticate to a downstream API as the calling user rather than with a single shared service credential. Pontifex exchanges the caller's token at your IdP for one scoped to the downstream's audience — the inbound token is never forwarded (no passthrough). Works with any RFC 8693 provider (Keycloak, Auth0, Microsoft Entra, Okta). Enable with type: token_exchange in a connector's config, or TokenExchange(...) in code. API-key callers (no user token to exchange) are cleanly rejected. (#44)

Shared encrypted token cache

Exchanged tokens can be cached in Redis across workers (PONTIFEX_TOKEN_CACHE=redis), encrypted at rest with a Fernet key held in the environment — a Redis dump yields only ciphertext. The default remains in-process memory. External-KMS key management is tracked in #52. (#47)

Enhancements

  • Audit log records per-user delegations via a new delegated_audience column — auditors can see which downstream a user's credential was delegated to (never the token). (#45)
  • Metrics for the token-exchange path (exchange latency, outcomes, cache hit/miss/coalesced) when Logfire is configured. (#48)

Fixes

  • Isolate the IdP circuit breaker from the downstream connector breaker, so an IdP outage no longer trips the downstream breaker or locks out callers whose delegated token is still cached. (#46)

Docs

  • New token-exchange and token-cache guidance on the Connectors page, including the two-persona (service credential vs. user identity) framing.

Full Changelog: v0.2.0...v0.3.0

Assets 2
Loading