RS/PS/ES families) or against the client secret (HS family), together with iss, aud/azp, exp/nbf/iat (60 s clock skew) and the nonce of the login. An id token which is present but invalid aborts the login. alg: none and unknown algorithms are rejected, and the algorithm determines the accepted key type, which rules out algorithm confusion; a crit header is rejected as well. New classes TokenVerifier, Jws, JwsAlgorithm, JwksClient, JwksProvider, JsonWebKeys — implemented with the crypto primitives of the JDK, so the plugin still has no runtime dependencies of its own.id_token_hint. The principal of the logout is taken from the access token cookie through the AccessTokenResolver of the core (signature and expiry checked) instead of parsing the token payload unverified; the helper JwtPayload is gone.jwksUrl for manually configured endpoints; with a discovery url the key set url and the issuer come from the document (jwks_uri, issuer).de/l9g/scm/oauth2/plugin/package-info.java describing the complete login, group synchronization and logout flow, the class map and the extension points used, as entry point for new developers.-Pstage=release: the generated api documentation is written to docs/javadoc next to the sources instead of into the build directory, so it can be committed with the release (./gradlew javadoc -Pstage=release, or as part of ./gradlew build -Pstage=release). The directory is emptied before it is regenerated.docs/, derived from the source code: PROZESS_BESCHREIBUNG.md (processing operations, data categories, storage locations and retention, recipients — basis for a record of processing activities under art. 30 GDPR), COMPLIANCE_BERICHT.md (assessment against GDPR and the NIS2 risk management measures of art. 21(2), with 19 implemented technical measures, 2 open findings and 3 documented residual risks), DATENSCHUTZ_FOLGEABSCHAETZUNG.md (threshold analysis and voluntary data protection impact assessment under art. 35 GDPR with 11 assessed risks) and SOURCECODE_STATISTIK.md (size, test coverage, documentation ratio and dependencies, with reproducible measurement commands).author is now Thorsten Ludewig.First released version. Authentication for SCM-Manager against an OAuth2/OIDC identity provider (developed and tested against Keycloak).
\n/api/v2/oauth2/auth, callback endpoint /api/v2/oauth2/auth/callback, OAuth2Realm as shiro realm and an access token cookie issued by the core.state values with a ten minute lifetime, additionally bound to the browser which started the flow through the X-SCM-OAuth2-State cookie (RFC 9700, section 4.7); the number of pending authorization requests is capped..well-known/openid-configuration (cached for one hour, invalidated when the discovery url changes); manual configuration of the single endpoints stays possible.migrateLocalUsers is enabled./developers) are sanitized by replacing the invalid characters with _.realm_access.roles), for providers which do not expose roles through the userinfo endpoint.scmadmin) is part of the claim, the global * permission is assigned on login and revoked again when the group is gone.forceLogin).ssoLogout), passing id_token_hint and post_logout_redirect_uri so the provider does not ask for confirmation and returns to SCM-Manager afterwards./api/v2/oauth2/configuration (permission configuration:read,write:oauth2) including OpenAPI documentation.scm-server.json.