Skip to content

Commit c8a259a

Browse files
zandbeltzandbelt
committed
release 3.2.1; depend on liboauth2 1.4.1
with support for RFC 8705 mTLS Client Certificate bound access tokens Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
1 parent bd5a236 commit c8a259a

4 files changed

Lines changed: 23 additions & 14 deletions

File tree

‎ChangeLog‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
01/25/2021
2-
- add TLS Client Certificate bound access token support
1+
02/01/2021
2+
- depend on liboauth2 1.4.1 with support for RFC 8705 mTLS Client Certificate bound access tokens
3+
- release 3.2.1
34

45
12/22/2020
56
- depend on liboauth2 1.4.0

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@ AuthType oauth2
1818
OAuth2TokenVerify jwks_uri https://pingfed:9031/ext/one jwks_uri.ssl_verify=false
1919
```
2020

21+
RFC 8705 Mutual TLS Certificate (optionally) Bound JWT Bearer Access Token validation with a known JWK
22+
```apache
23+
AuthType oauth2
24+
OAuth2TokenVerify jwk "{\"kty\":\"RSA\",\"kid\":\"one\",\"use\":\"sig\",\"n\":\"12SBWV_4xU8sBEC2IXcakiDe3IrrUcnIHexfyHG11Kw-EsrZvOy6PrrcqfTr1GcecyWFzQvUr61DWESrZWq96vd08_iTIWIny8pU5dlCoC7FsHU_onUQI1m4gQ3jNr00KhH878vrBVdr_T-zuOYQQOBRMEyFG-I4nb91zO1n2gcpQHeabJw3JIC9g65FCpu8DSw8uXQ1hVfGUDZAK6iwncNZ1uqN4HhRGNevFXT7KVG0cNS8S3oF4AhHafFurheVxh714R2EseTVD_FfLn2QTlCss_73YIJjzn047yKmAx5a9zuun6FKiISnMupGnHShwVoaS695rDmFvj7mvDppMQ\",\"e\":\"AQAB\" }" type=mtls&mtls.policy=optional
25+
SSLVerifyClient optional_no_ca
26+
```
27+
2128
For a detailed overview of configuration options see the `oauth2.conf` Apache configuration file in this directory.
2229

2330
## Features

‎configure.ac‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
AC_INIT([mod_oauth2],[3.2.0],[hans.zandbelt@zmartzone.eu])
1+
AC_INIT([mod_oauth2],[3.2.1],[hans.zandbelt@zmartzone.eu])
22

33
AM_INIT_AUTOMAKE([foreign no-define subdir-objects])
44
AC_CONFIG_MACRO_DIRS([m4])
@@ -32,11 +32,11 @@ PKG_CHECK_MODULES(APR, [apr-1, apr-util-1])
3232
AC_SUBST(APR_CFLAGS)
3333
AC_SUBST(APR_LIBS)
3434

35-
PKG_CHECK_MODULES(OAUTH2, [liboauth2 >= 1.4.0])
35+
PKG_CHECK_MODULES(OAUTH2, [liboauth2 >= 1.4.1])
3636
AC_SUBST(OAUTH2_CFLAGS)
3737
AC_SUBST(OAUTH2_LIBS)
3838

39-
PKG_CHECK_MODULES(OAUTH2_APACHE, [liboauth2_apache >= 1.4.0])
39+
PKG_CHECK_MODULES(OAUTH2_APACHE, [liboauth2_apache >= 1.4.1])
4040
AC_SUBST(OAUTH2_APACHE_CFLAGS)
4141
AC_SUBST(OAUTH2_APACHE_LIBS)
4242

‎oauth2.conf‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,20 @@
2020
#
2121
# <type> <value> <description> <options> (provided in query-encoded format)
2222
#
23-
# introspect <url> RFC7662 introspection URL introspect.ssl_verify, introspect.auth, introspect.cache, introspect.expiry,
24-
# jwks_uri <url> JWKS URI that serves the public keys jwks_uri.ssl_verify, jwks_uri.cache, jwks_uri.expiry,
23+
# introspect <url> RFC7662 introspection URL introspect.ssl_verify, introspect.auth, introspect.cache, introspect.expiry, type
24+
# jwks_uri <url> JWKS URI that serves the public keys jwks_uri.ssl_verify, jwks_uri.cache, jwks_uri.expiry, type,
2525
# verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
26-
# jwk <json> JWK JSON representation of a symmetric kid (overrides kid in JWK), verify.iss, verify.exp, verify.iat,
26+
# jwk <json> JWK JSON representation of a symmetric kid (overrides kid in JWK), verify.iss, verify.exp, verify.iat, type,
2727
# key or a public key verify.iat.slack_before, verify.iat.slack_after
2828
# metadata <url> RFC8414 Authorization Server Metadata metadata.ssl_verify, introspect.*, jwks_uri.*
2929
# URL that contains a JWKs URI in jwks_uri
30-
# plain <string> symmetric key (password) in plain text kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
31-
# base64 <string> base64-encoded symmetric key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
32-
# base64url <string> base64url-encoded symmetric key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
33-
# hex <string> hex-encoded symmetric key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
34-
# pem <string> PEM formatted X.509 certificate kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
30+
# plain <string> symmetric key (password) in plain text kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after, type
31+
# base64 <string> base64-encoded symmetric key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after, type
32+
# base64url <string> base64url-encoded symmetric key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after, type
33+
# hex <string> hex-encoded symmetric key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after, type
34+
# pem <string> PEM formatted X.509 certificate kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after, type
3535
# that contains an RSA public key
36-
# pubkey <string> PEM formatted RSA public key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
36+
# pubkey <string> PEM formatted RSA public key kid, verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after, type
3737
# eckey_uri <url> URL on wich the Elliptic Curve key is eckey_uri.ssl_verify, eckey_uri.cache, eckey_uri.expiry,
3838
# published as a PEM (Amazon ALB specific) verify.iss, verify.exp, verify.iat, verify.iat.slack_before, verify.iat.slack_after
3939
#
@@ -48,6 +48,7 @@
4848
# verify.iat skip|optional|required how to validate the "iat" claim in the JWT: skip it, verify if present, require claim to be present and validate
4949
# verify.iat.slack_before <number> acceptable clock drift in seconds for the "iat" claim: anything issued before now-number will be rejected
5050
# verify.iat.slack_after <number> acceptable clock drift in seconds for the "iat" claim: anything issued after now+number will be rejected
51+
# type [mtls|dpop] type of proof of possession, mtls.policy=[optional|required]
5152
# cache <string> cache backend name for access token validation results,
5253
# default is "default", otherwise must refer to a named cache defined with OAuth2Cache
5354
# expiry <number> cache expiry in seconds for access token validation results

0 commit comments

Comments
 (0)