- Shipped
- 15 listopada 2026 10:52 UTC
- Author
- Kamo
- Commit
- fc3c53b
Grows oauthserver/ (never forked): per-org issuer pinned at first enable (https://login.<verified+ssl root>, else login.<platform apex>/o/<orgId>; previous issuers still served), ES256 signing keys encrypted with PlatformSecretCipher and a NEXT->CURRENT->RETIRED rotation job (SingletonTaskRunner), discovery + RFC 8414 metadata + JWKS, id_token (nonce, auth_time, amr, acr, at_hash, sid; pairwise sub option), userinfo, client-authenticated introspection, PAR, RP-initiated end-session + back-channel logout tokens, RFC 9207 iss on every connected-app authorization response. Purpose CONNECTED_APP with Member/Customer principal providers beside the voice-link ones; access policy (departments/job titles/teams/members/ customers) at authorize; consent ASK/PREAPPROVED stored as one ACTIVE grant per member (widened, never replaced); provider SSO session = the OAuth-mode sign-in's *** ("Continue as", prompt=none). Admin API /api/security/connected-apps (MANAGE_CONNECTED_APPS) and /api/security/my-app-grants. PKCE required for public clients (auth method none), exact redirect matching kept. The Alexa / Google Home / Assistant clients (org_id NULL = platform rows) keep the SP09 flow byte for byte; the platform page lists only them.