Release v22.145.0

Arc can now accept a session in which a support person or an agent acts on behalf of a user through Cratis AuthProxy: the request authorizes as the represented user, and Chronicle records the actor as the cause, on behalf of that user.

Added

• Opt-in on-behalf forwarding through ArcOptions.OnBehalfOf (Cratis:Arc:OnBehalfOf). Arc verifies AuthProxy's signed x-cratis-on-behalf-assertion against the configured issuer, audience, optional service and RSA public signing keys, binds it to the forwarded identity headers, tenant and request, and refuses a replay. See Acting on behalf of a user. (#3535)
• A verified on-behalf forward authenticates as the represented user with the actor from x-cratis-on-behalf-actor as ClaimsIdentity.Actor, in both the ASP.NET Core Microsoft Identity Platform scheme and the Cratis.Arc.Core handler.
• ClaimsPrincipal.GetActor() and ClaimsPrincipal.IsActedOnBehalfOf() in Cratis.Arc.Identity to read who is acting.
• With Chronicle, an identity that has an actor is recorded as a CausedBy chain with the actor first and the represented user as its OnBehalfOf, so events report an agent acting on behalf of that user.
• x-ms-client-principal-id values in the RFC 8187 UTF-8'' form are decoded.
• An ASP.NET Core host logs an error at startup when on-behalf forwarding is enabled with configuration it cannot use.

Changed

• Requests carrying an x-cratis-on-behalf-actor or x-cratis-on-behalf-assertion header now fail authentication unless forwarded identity headers are trusted, on-behalf forwarding is enabled and the assertion verifies. They are never authenticated as the represented user or the actor alone.
• Any authentication scheme that sets ClaimsIdentity.Actor, such as a bearer token whose act claim is mapped to it, now changes the identity Chronicle records: the actor becomes causedBy, on behalf of the principal. See Causation.