feat: RFC 8705 mutual-TLS client authentication for CF app instance identity - #3972

Draft

rkoster wants to merge 30 commits into

cloudfoundry:developfrom

rkoster:feat/rfc8705-mtls-client-auth

Commits on Jul 3, 2026

feat(model): add tls_client_auth constant and logic to ClientAuthentication
rkoster
committed
feat(model): add CLIENT_AUTH_TLS_CLIENT_AUTH to TokenConstants
rkoster
committed
feat(model): add TlsClientAuthConfiguration model class
rkoster
committed
feat(model): add tlsClientAuthConfiguration field to UaaClientDetails
rkoster
committed
fix(model): add equals/hashCode to TlsClientAuthConfiguration and ClaimMapping
rkoster
committed
feat(model): add mtls_endpoint_aliases and tls_client_auth to OpenIdConfiguration
rkoster
committed
feat(server): add java-buildpack-client-certificate-mapper-jakarta dependency
rkoster
committed
feat(server): register ClientCertificateMapper filter for /oauth/mtls/*
rkoster
committed
feat(server): add TlsClientAuthentication cert chain validation service
rkoster
committed
feat(server): add isTlsClientAuth / validateTlsClientAuth to ClientDetailsAuthenticationProvider
rkoster
committed
fix(server): deserialize TlsClientAuthConfiguration from additionalInformation Map
rkoster
committed
feat(server): allow tls_client_auth in ClientCredentialsTokenGranter
rkoster
committed
feat(server): add MtlsClaimsEnhancer UaaTokenEnhancer for cert-derived JWT claims
rkoster
committed
feat(server): add mtls_endpoint_aliases to OIDC discovery document
rkoster
committed
Fix @Value key in OpenIdConnectEndpoints to match ERB-emitted mtls.endpoint
rkoster
committed
fix(server): add OAUTH_11 order constant and dedicated mTLS security filter chain
rkoster
committed
fix(server): handle flat String PEM in getTlsClientAuthConfiguration; expose /oauth/mtls/token
rkoster
committed
fix(server): fix MtlsClaimsEnhancer for DB-loaded clients and Diego multi-valued RDNs
rkoster
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: RFC 8705 mutual-TLS client authentication for CF app instance identity - #3972

feat: RFC 8705 mutual-TLS client authentication for CF app instance identity#3972
rkoster wants to merge 30 commits into
cloudfoundry:developfrom
rkoster:feat/rfc8705-mtls-client-auth

Commits on Jul 3, 2026

feat(model): add tls_client_auth constant and logic to ClientAuthentication

feat(model): add CLIENT_AUTH_TLS_CLIENT_AUTH to TokenConstants

feat(model): add TlsClientAuthConfiguration model class

feat(model): add tlsClientAuthConfiguration field to UaaClientDetails

fix(model): add equals/hashCode to TlsClientAuthConfiguration and ClaimMapping

feat(model): add mtls_endpoint_aliases and tls_client_auth to OpenIdConfiguration

feat(server): add java-buildpack-client-certificate-mapper-jakarta dependency

feat(server): register ClientCertificateMapper filter for /oauth/mtls/*

feat(server): add TlsClientAuthentication cert chain validation service

feat(server): add isTlsClientAuth / validateTlsClientAuth to ClientDetailsAuthenticationProvider

fix(server): deserialize TlsClientAuthConfiguration from additionalInformation Map

feat(server): allow tls_client_auth in ClientCredentialsTokenGranter

feat(server): add MtlsClaimsEnhancer UaaTokenEnhancer for cert-derived JWT claims

feat(server): add mtls_endpoint_aliases to OIDC discovery document

Fix @Value key in OpenIdConnectEndpoints to match ERB-emitted mtls.endpoint

fix(server): add OAUTH_11 order constant and dedicated mTLS security filter chain

fix(server): handle flat String PEM in getTlsClientAuthConfiguration; expose /oauth/mtls/token

fix(server): fix MtlsClaimsEnhancer for DB-loaded clients and Diego multi-valued RDNs

Commits on Jul 6, 2026

fix(review): address PR feedback on mTLS client auth

test: update OIDC discovery tests for mtls_endpoint_aliases and tls_client_auth

fix(review): fix JsonProperty collision and support full cert chain in mTLS auth

Commits on Jul 7, 2026

test: update tlsClientAuthConfigRoundTripsViaJson for @JsonIgnore design

feat: add subTemplate and audTemplates to TlsClientAuthConfiguration

test: fix audTemplates equality isolation in TlsClientAuthConfigurationTest

refactor: restructure enhance() into phase 1/2 (vars + dot-notation)

fix: document single-level nesting, add conflict test, restore comment

feat: add phase 3 sub/aud template rendering to MtlsClaimsEnhancer

fix: static PLACEHOLDER pattern, StringBuilder, restore comment, rename test

feat: read tls-client-auth-sub-template and aud-templates from flat BOSH String path

fix: apply token enhancer overrides after UAA defaults so sub/aud templates win