5015f3dd43
C-1: Keycloak driver now verifies JWT signatures via JWKS.
Forged tokens are rejected. Previously any base64 JWT was accepted.
C-2: on_behalf_of requires gsap:impersonate role in JWT claims.
C-3: Entra driver denies on JWKS failure (no unverified fallback).
H-10: JWKS cache refreshes on kid miss for key rotation.
Shared JWKSVerifier used by both drivers. alg=none blocked.
iss, aud, exp validated for all tokens.
Signed-off-by: Tyler King <tking@guildhouse.dev>
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| authorize.py | ||
| complete.py | ||
| connectors.py | ||
| drivers.py | ||
| elevate.py | ||
| functions.py | ||
| health.py | ||
| session.py | ||