Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Release Notes
00.78.00

00.78.00

Available on Maven Central. The identity-federation release: OpenID Connect Relying-Party on top of the 00.76 JWT and 00.77 OAuth2 building blocks. Additive — three new opt-in modules; every 00.74–00.77 app compiles and boots identically. The current release is 00.79.41.

Release date: 2026-06-27 Previous release: 00.77.00 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.78.00 Full changelog: GitHub release v00.78.00

Headline — the full OIDC RP protocol surface

Three new modules (jSentinel-identity-oidc, jSentinel-identity-oidc-vaadin, jSentinel-identity-oidc-rest):

  • ID-token validation (OIDC Core §3.1.3.7) — composes the 00.76 JwtValidator, then checks nonce, azp (on multi-audience), at_hash / c_hash (constant-time), auth_time vs max_age and acr. No JOSE import; hashes via the JDK MessageDigest.
  • Discovery (OIDC Discovery 1.0 / RFC 8414) — <issuer>/.well-known/openid-configuration, rejects an issuer-substituted document, TTL-cached, strict in-tree JSON parser.
  • UserInfo (§5.3) — Bearer GET, https-enforced, 1 MiB cap, sub-match enforced.
  • RP-Initiated Logout — builds the end_session_endpoint URL (id_token_hint + post_logout_redirect_uri + state).
  • Claims-to-subject mapping — builds the stable 4-field JSentinelSubject with an issuer-prefixed, injective id; roles / permissions / tenant via dedicated mapper SPIs (empty by default — vendor mappings are 00.79).
  • @OidcAuthenticated — maps an insufficient acr to AuthorizationDecision.StepUpRequired, tying jSentinel step-up to OIDC acr_values.

Bootstrap — .oidc(...)

A declarative .oidc(...) sub-builder on all three adapter facades; the DX layer only records + STRICT-validates against the JOSE-free oidc/api + oauth2/api core types (codes: oidc/missing-issuer, oidc/scope-without-openid, oidc/redirect-uri-not-https, …). Four new non-secret event types (IdTokenValidated / …Failed, OidcLoginSucceeded, OidcLogout).

Security properties

ID-token signature via the 00.76 allow-list (no alg:none); nonce required + single-use + constant-time; at_hash / c_hash per §3.1.3.6; azp enforced on multi-audience; discovery rejects an issuer-substituted document; tokens never logged; bodies capped at 1 MiB; subject ids issuer-prefixed + injective. A three-reviewer exit pass fixed four findings in-cycle — notably an injective %/#-escaped iss#sub id (R-EXIT-1) and a UserInfo sub-mismatch rejection (R-EXIT-2, §5.3.2 identity-substitution defence).

Quality

Full reactor (46 modules) clean install green; -Pstatic-analysis verify green. No mocks — the ID-token validator runs a real Nimbus JwtValidator over a real RSA JWKS key against real Nimbus-signed ID tokens; discovery / UserInfo / logout run against real JDK HttpServer round-trips. jSentinel-identity-oidc first PIT pass: 72 % (170/235) / 84 % line.

What it does not do

Vendor claim/role profiles (Keycloak / Entra / Auth0 / …), hybrid-flow, front-channel logout and the coordinated stable-API promotion are 00.79. All 00.78 public types are @ExperimentalJSentinelApi.

Migration

None. The OIDC RP is opt-in; apps that don’t call .oidc(...) pull no new dependency. Just bump the version to 00.78.00.

00.77.0000.79.00