feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.

2026-10-30 01:01:45 +01:00
1 parent 3ed79c7563
commit 3c4c5a8c32
@@ -1,3 +1,32 @@
+vpn-router (0.37.0-1) unstable; urgency=medium
+
+  feature: the OpenID Provider has the client credentials and device authorization grants, public clients, and service accounts as resources with roles and scopes in JWT access tokens.
+
+  * A client may have the grants client_credentials, by which a
+    confidential client gets an access token as its own service account,
+    and the device code (RFC 8628): POST /oidc/device_authorization gives
+    a device code and a user code, the user enters the code on
+    /oidc/device, signs in and allows or denies the device, and the device
+    polls /oidc/token. A public client has no secret.
+  * An http loopback redirect URI matches with any port.
+  * Every service account is a resource: it defines scopes, which clients
+    ask for as <resource>:<scope> when their client scopes allow them, and
+    roles, assigned to groups, users and service accounts. A token request
+    names its resource with resource (RFC 8707) or by its scopes.
+  * Access tokens are RS256 JWTs of RFC 9068 for the resource, or the
+    client, with client_id, scope, roles and the claims of the scopes; ID
+    tokens and /oidc/userinfo carry the user's roles of the client.
+  * vpn-router-user takes --grant, --public-client, --client-scope and
+    --resource-scope; the new vpn-router-role manages the roles; and
+    /service-accounts takes and answers grants, public_client,
+    client_scopes, resource_scopes and roles.
+  * Changing the password of a service account, disabling, unlocking or
+    removing it through /service-accounts revokes its tokens.
+  * POST /oidc/device and /oidc/device_authorization are rate limited as
+    /oidc/login is.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 30 Oct 2026 00:57:11 +0100
+
 vpn-router (0.36.0-1) unstable; urgency=medium

  feature: a shell opens with one of the user's passkeys in place of the password and the TOTP code.
@@ -21,6 +21,7 @@ src/usr/lib/vpn-router/editor-file                    usr/lib/vpn-router/
 src/usr/bin/vpn-router-editor                         usr/bin/
 src/usr/sbin/vpn-router-user                          usr/sbin/
 src/usr/sbin/vpn-router-group                         usr/sbin/
+src/usr/sbin/vpn-router-role                          usr/sbin/
 src/usr/sbin/vpn-router-token                         usr/sbin/
 src/usr/sbin/vpn-config-edit                          usr/sbin/
 src/usr/sbin/vpn-router-backup                        usr/sbin/