Skip to content
This repository was archived by the owner on Sep 2, 2025. It is now read-only.

v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 May 15:24
· 265 commits to main since this release
v1.0.0
eb10752
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

1.0.0 (2023-05-25)

Bug Fixes

  • add authorization to cors (#48) (d02653e)
  • add authorizations to userinfo (#37) (2966355)
  • add code_challenge_methods_supported to discovery endpoint (#43) (57cf8ee)
  • Add db scanner methods for SpaceDelimitedArray (#194) (5fb36bf)
  • add missing WithCustomEndSessionEndpoint (5af734d)
  • add missing WithCustomKeysEndpoint (c3e583b)
  • allow additional scopes (#69) (2370409)
  • allow http schema for redirect url for native apps in dev mode (#242) (a314c14)
  • allow loopback redirect_uri for native apps (72fc861)
  • allow RFC3339 encoded time strings (711a194), closes #292
  • allowed ConcatenateJSON with empty input (#138) (c45f03e)
  • another typo (4cf6c6d)
  • append client id to aud (#71) (13b1473)
  • aud (a731a46)
  • avoid potential race conditions (#220) (c4b7ef9)
  • change callbackpath (#74) (27f3bc0)
  • change channel for GetSigningKey to time (a2e2f06)
  • Change op.tokenHandler to follow the same pattern as the rest of the endpoint handlers (#210) (2d248b1)
  • check grant types and add refresh token to discovery (14faebb)
  • check refresh token grant type (#100) (3e336a4)
  • cli client (#92) (5cd7bae)
  • cli: added implementation for token to client for caching (#29) (303fdfc)
  • clock skew when using jwt profile (b23f37f)
  • code challenge (c316986)
  • correct returned field for JWTTokenRequest (a08ce50), closes #283
  • create access token from storage (5e7e5eb)
  • custom absolute endpoints (660519a)
  • decode basic auth header components (clientID, clientSecret) (deb3365)
  • dependencies (5b6175a)
  • do not modify userInfo when marshaling (e1d50fa)
  • Ease dev host name constraints (8661300)
  • encoding of basic auth header values (d7d7daa)
  • end session (#35) (628bc4e)
  • ensure signer has key on OP creation (e39146c)
  • exchange cors library and add X-Requested-With to Access-Control-Request-Headers (#260) (b031c1f)
  • explicit allow Origin from request (c88e6b4)
  • glob support for RedirectURIs (7e57985), closes #293
  • grant_types_supported in discovery (2ebbd7a)
  • handle code separately (#30) (58545a1)
  • handle keys without use in FindMatchingKey (bcd9ec8)
  • handle single aud string claim, extract en/decoder interface, comments (#51) (abd3b6f)
  • handle the zero cases for oidc.Time (115813e)
  • implement storage (7700cb3)
  • improve error handling when getting ClientIDFromRequest (#359) (dc2bdc6)
  • improve example & fix userinfo marshal (#132) (ff2c164)
  • improve interceptor handling (#49) (c828290)
  • improve JWS and key verification (#128) (a63fbee)
  • jwt profile request in op (fd3daa2)
  • make checkKey public (7e2c22f)
  • make GenerateJWTProfileToken public (#82) (fa92a20)
  • make pkce code_verifier spec compliant #125 (fcad98f)
  • make pkce code_verifier spec compliant #125 (af3a497), closes /datatracker.ietf.org/doc/html/rfc7636#section-4
  • marshal user info address (#58) (60560ce)
  • merge user info claims into id token claims (#349) (be3cc13)
  • move to new org (#177) (550f787)
  • nil pointer dereference on UserInfoAddress (#207) (fa222c5), closes #203 #203
  • Only set GrantType once (#353) (1a2db36), closes #352
  • parse error (cae42cc)
  • parse max_age and prompt correctly (and change scope type) (#105) (400f5c4)
  • possible nil pointer on userinfo (f40a07f)
  • remove bracket (#40) (3507057)
  • remove signing key creation (when not found) (06dcac4)
  • remove test because we know it works. :P (28f731c)
  • removeUserinfoScopes return new slice (without manipulating passed one) (#110) (1132c9d)
  • resolve nil pointer panic in Authorize (#358) (057538d), closes #315
  • return error when delegating user in jwt profile request (#94) (a2601f1)
  • rp verification process (#95) (850faa1)
  • rp.RefreshAccessToken did not work (#216) (88a98c0)
  • simplify JWTProfileVerifier interface (39fef3e)
  • state and auth code response encoding (#185) (854e14b)
  • storage interface (17a72cc)
  • supported ui locales from config (#107) (8a35b89)
  • token type from client for device auth (#398) (09bdd1d)
  • typo (df432c8)
  • unmarshalling of audience as array (#53) (f645dd3)
  • unmarshalling of scopes in access token (#320) (eea2ed1), closes #318
  • unmarshalling of scopes in access token (#327) (c6820ba), closes #318
  • url safe encryption with no padding (#93) (b258b3c)
  • use default redirect uri when not passed on end_session endpoint (#201) (53ede2e)
  • use Form instead of PostForm in ClientIDFromRequest (#360) (c72aa8f)
  • use the same schema encoder everywhere (#299) (4dca29f), closes #295
  • UserInfo with JWT access token (return error in DecryptAES) (9b480be)
  • version (535c758)
  • version! (80f1272)
  • WithPath on NewCookieHandler set domain instead! (#240) (89d1c90)
  • wrap original fetch key error (f2f509a)

chore

  • remove unused context in NewOpenIDProvider (4bd2b74)

Code Refactoring

  • use struct types for claim related types (#283) (dea8bc9)

Features

BREAKING CHANGES

  • The following types are changed from interface to struct type:
  • AccessTokenClaims
  • IDTokenClaims
  • IntrospectionResponse
  • UserInfo and related types.

The following methods of OPStorage now take a pointer to a struct type,
instead of an interface:

  • SetUserinfoFromScopes
  • SetUserinfoFromToken
  • SetIntrospectionFromToken

The following functions are now generic, so that type-safe extension
of Claims is now possible:

  • op.VerifyIDTokenHint

  • op.VerifyAccessToken

  • rp.VerifyTokens

  • rp.VerifyIDToken

  • Changed UserInfoAddress to pointer in UserInfo and
    IntrospectionResponse.
    This was needed to make omitempty work correctly.

  • Copy or merge maps in IntrospectionResponse and SetUserInfo

  • op: add example for VerifyAccessToken

  • fix: rp: wrong assignment in WithIssuedAtMaxAge

WithIssuedAtMaxAge assigned its value to v.maxAge, which was wrong.
This change fixes that by assiging the duration to v.maxAgeIAT.

  • rp: add VerifyTokens example

  • oidc: add standard references to:

  • IDTokenClaims
  • IntrospectionResponse
  • UserInfo
  • only count coverage for ./pkg/...
    • op.NewOpenIDProvider
  • op.NewDynamicOpenIDProvider

The call chain of above functions did not use the context anywhere.
This change removes the context from those fucntion arguments.

  • op: The OpenID Provider package is now able to handle multiple issuers with a single storage implementation. The issuer will be selected from the host of the request and passed into the context, where every function can read it from if necessary. This results in some fundamental changes:
  • Configuration interface:
    • Issuer() string has been changed to IssuerFromRequest(r *http.Request) string
    • Insecure() bool has been added
  • OpenIDProvider interface and dependants:
    • Issuer has been removed from Config struct
    • NewOpenIDProvider now takes an additional parameter issuer and returns a pointer to the public/default implementation and not an OpenIDProvider interface:
      NewOpenIDProvider(ctx context.Context, config *Config, storage Storage, opOpts ...Option) (OpenIDProvider, error) changed to NewOpenIDProvider(ctx context.Context, issuer string, config *Config, storage Storage, opOpts ...Option) (*Provider, error)
    • therefore the parameter type Option changed to the public type as well: Option func(o *Provider) error
    • AuthCallbackURL(o OpenIDProvider) func(string) string has been changed to AuthCallbackURL(o OpenIDProvider) func(context.Context, string) string
    • IDTokenHintVerifier() IDTokenHintVerifier (Authorizer, OpenIDProvider, SessionEnder interfaces), AccessTokenVerifier() AccessTokenVerifier (Introspector, OpenIDProvider, Revoker, UserinfoProvider interfaces) and JWTProfileVerifier() JWTProfileVerifier (IntrospectorJWTProfile, JWTAuthorizationGrantExchanger, OpenIDProvider, RevokerJWTProfile interfaces) now take a context.Context parameter IDTokenHintVerifier(context.Context) IDTokenHintVerifier, AccessTokenVerifier(context.Context) AccessTokenVerifier and JWTProfileVerifier(context.Context) JWTProfileVerifier
    • OidcDevMode (CAOS_OIDC_DEV) environment variable check has been removed, use WithAllowInsecure() Option
  • Signing: the signer is not kept in memory anymore, but created on request from the loaded key:
    • Signer interface and func NewSigner have been removed
    • ReadySigner(s Signer) ProbesFn has been removed
    • CreateDiscoveryConfig(c Configuration, s Signer) *oidc.DiscoveryConfiguration has been changed to CreateDiscoveryConfig(r *http.Request, config Configuration, storage DiscoverStorage) *oidc.DiscoveryConfiguration
    • Storage interface:
      • GetSigningKey(context.Context, chan<- jose.SigningKey) has been changed to SigningKey(context.Context) (SigningKey, error)
      • KeySet(context.Context) ([]Key, error) has been added
      • GetKeySet(context.Context) (*jose.JSONWebKeySet, error) has been changed to KeySet(context.Context) ([]Key, error)
    • SigAlgorithms(s Signer) []string has been changed to SigAlgorithms(ctx context.Context, storage DiscoverStorage) []string
    • KeyProvider interface: GetKeySet(context.Context) (*jose.JSONWebKeySet, error) has been changed to KeySet(context.Context) ([]Key, error)
    • CreateIDToken: the Signer parameter has been removed

  • move example

  • fix examples

  • fix mocks

  • update readme

  • fix examples and update usage

  • update go module version to v2

  • build branch

  • fix(module): rename caos to zitadel

  • fix: add state in access token response (implicit flow)

  • fix: encode auth response correctly (when using query in redirect uri)

  • fix query param handling

  • feat: add all optional claims of the introspection response

  • fix: use default redirect uri when not passed

    • move functions from utils package into separate packages
Assets 2
Loading