fix(auth): close SSO/OIDC auth-strength and conformance gaps

David commented

2026-06-13 16:50:38 +02:00

Owner

Mint first-party tokens with the originating session's real acr/amr instead of a hardcoded pwd LoA, so MFA and trust-bypass sessions are reported accurately at login (auth.rs) and on tenant switch (tenants.rs looks the OP session up by sid to preserve its strength).

Enforce OIDC prompt and grant-type rules at /authorize: honor prompt=login by forcing re-auth before reusing an existing session, reject clients lacking the authorization_code grant with unauthorized_client before a code is minted, and remove the unreachable prompt=none block by checking it before the session unwrap.

Expose the authz-gating mokosh_active_tenant claim at /userinfo and advertise it in discovery claims_supported.

Verify feedback bearer tokens with EdDSA and an at+jwt typ check (was RS256, which never validated, silently treating signed-in callers as anonymous).

Record the ambiguous-email, no-such-user, and inactive-status audit events in verify_only so its failure trail matches login.

Revoke each session's refresh families on user suspend and delete, so a stolen refresh token cannot outlive the account.

#PMS-191

Mint first-party tokens with the originating session's real acr/amr instead of a hardcoded pwd LoA, so MFA and trust-bypass sessions are reported accurately at login (auth.rs) and on tenant switch (tenants.rs looks the OP session up by sid to preserve its strength). Enforce OIDC prompt and grant-type rules at /authorize: honor prompt=login by forcing re-auth before reusing an existing session, reject clients lacking the authorization_code grant with unauthorized_client before a code is minted, and remove the unreachable prompt=none block by checking it before the session unwrap. Expose the authz-gating mokosh_active_tenant claim at /userinfo and advertise it in discovery claims_supported. Verify feedback bearer tokens with EdDSA and an at+jwt typ check (was RS256, which never validated, silently treating signed-in callers as anonymous). Record the ambiguous-email, no-such-user, and inactive-status audit events in verify_only so its failure trail matches login. Revoke each session's refresh families on user suspend and delete, so a stolen refresh token cannot outlive the account. #PMS-191

David added 1 commit

2026-06-13 16:50:38 +02:00

fix(auth): close SSO/OIDC auth-strength and conformance gaps

E2E / Playwright against staging (pull_request) Failing after 17s

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 1m25s

Details

Build OCI container / Build and push mokosh-api image (push) Successful in 3m37s

Details

a4fef72d44

Mint first-party tokens with the originating session's real acr/amr instead of a hardcoded pwd LoA, so MFA and trust-bypass sessions are reported accurately at login (auth.rs) and on tenant switch (tenants.rs looks the OP session up by sid to preserve its strength).

Enforce OIDC prompt and grant-type rules at /authorize: honor prompt=login by forcing re-auth before reusing an existing session, reject clients lacking the authorization_code grant with unauthorized_client before a code is minted, and remove the unreachable prompt=none block by checking it before the session unwrap.

Expose the authz-gating mokosh_active_tenant claim at /userinfo and advertise it in discovery claims_supported.

Verify feedback bearer tokens with EdDSA and an at+jwt typ check (was RS256, which never validated, silently treating signed-in callers as anonymous).

Record the ambiguous-email, no-such-user, and inactive-status audit events in verify_only so its failure trail matches login.

Revoke each session's refresh families on user suspend and delete, so a stolen refresh token cannot outlive the account.

#PMS-191

David added 1 commit

2026-06-13 23:09:44 +02:00

Merge origin/main into feat/pms-191-sso-oidc-security-gaps

Create release / Create release from merged PR (pull_request) Has been skipped

Details

E2E / Playwright against staging (pull_request) Failing after 19s

Details

Check / fmt + clippy + compile + tests (pull_request) Successful in 3m16s

Details

fbacbde5d2