00.79.00

Available on Maven Central. Etappe 1 of the 00.79 line: Identity Interop + the coordinated Stable-API promotion of the JWT / OAuth2 / OIDC surfaces, plus vendor profiles for the major IdPs. Additive — the promotion is a pure annotation removal (no behaviour change); apps keep compiling. The 00.79 line completed with 00.79.10 + 00.79.20 and took a security-hardening tick in 00.79.41 — the current release.

Release date: 2026-06-27 Previous release: 00.78.00 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.79.00 Full changelog: GitHub release v00.79.00

The first etappe of the 00.79 hardening/interop line. The remaining blocks (DPoP, replay-stores, logout-hardening, mTLS / PAR / JAR / JWE, FIPS) ship in 00.79.10 / 00.79.20.

Headline — Stable-API promotion

After three minor versions of soak time (00.76 → 00.78), the JWT / OAuth2 / OIDC SPI shapes have proven stable. 47 mature types lose @ExperimentalJSentinelApi and become stable API — JwtValidator / JwtSigner / AlgorithmAllowList, AuthorizationCodeFlow / TokenEndpointClient / RefreshTokenFamilyStore, IdTokenValidator / ClaimsToSubjectMapper / OidcBootstrap, and more. Interfaces henceforth grow only via default methods; records / enums change additively only. A reflection guard test locks the promotion. (VendorProfile and the in-flight 00.79 types keep their own soak time.)

Vendor profiles

Six opt-in modules package the IdP-specific claim mappers, so a consumer writes one line — .oidc(o -> o.vendor(KeycloakProfile.INSTANCE)) — instead of wiring each mapper:

Module	Maps
`jSentinel-identity-vendor-keycloak`	`realm_access.roles` + `resource_access.<client>.roles`
`jSentinel-identity-vendor-entra`	`roles` + `wids` + `groups`; `tid` → tenant
`jSentinel-identity-vendor-auth0`	namespaced roles claim + `permissions`
`jSentinel-identity-vendor-okta`	`groups` → roles
`jSentinel-identity-vendor-google`	hosted-domain `hd` → tenant
`jSentinel-identity-vendor-github`	UserInfo-only subject (`github#<login>`)

Every mapper reads only the signed ID-token claims (except GitHub, which is UserInfo-only by protocol) and is type-confusion-guarded (a string where a list was expected yields no roles, never a ClassCastException).

Test harness — `jSentinel-test-oidc`

StubIdentityProvider is a real JDK HttpServer OIDC provider stub (discovery / JWKS / token / UserInfo, signing real RS256 ID tokens) so an RP under test runs its actual pipeline with no mocks; MockClock is a controllable clock. Opt-in test scope — not for the production classpath.

Quality

Full reactor (53 modules) clean install green; -Pstatic-analysis verify green. No mocks — the stub harness drives the real RP pipeline against real RS256 signing; the Keycloak profile is proven end to end (100 % mutation on the representative vendor module). The promotion is a pure annotation removal, so the promoted modules keep their prior PIT baselines.

What it does not do

Etappe 2 (00.79.10): replay-stores (JtiStore / NonceStore), DPoP (RFC 9449), back-/front-channel logout. Etappe 3 (00.79.20): mTLS (RFC 8705), PAR (RFC 9126), JAR (RFC 9101), JWE decoding, FIPS profile. VendorProfile + the .vendor(...) hook stay @ExperimentalJSentinelApi.

Migration

None. The promotion is annotation-only; vendor profiles and the test harness are opt-in. Just bump the version to 00.79.00.

00.78.00 00.79.10