git.stella-ops.org/docs/updates/2025-10-20-authority-identity-registry.md

2025-10-20 — Authority Identity Provider Registry & DPoP nonce updates

Summary

• Authority host now resolves identity providers through the new metadata/handle pattern introduced in StellaOps.Authority.Plugins.Abstractions. Runtime handlers (ValidateClientCredentialsHandler, ValidatePasswordGrantHandler, ValidateAccessTokenHandler, bootstrap endpoints) acquire providers with IAuthorityIdentityProviderRegistry.AcquireAsync and rely on metadata (AuthorityIdentityProviderMetadata) for capability checks.
• Unit and integration tests build lightweight ServiceProvider instances with test plugins, matching production DI behaviour and ensuring the new registry contract is exercised.
• DPoP nonce enforcement now prefers NormalizedAudiences when populated and gracefully falls back to the configured RequiredAudiences, eliminating the runtime type mismatch that previously surfaced during test runs.

Operator impact

• No configuration changes are required; existing YAML and environment-based settings continue to function.
• Documentation examples referencing password/mTLS bootstrap flows remain accurate. The new registry logic simply ensures providers advertised in configuration are resolved deterministically and capability-gated before use.

Developer notes

• When adding new identity providers or tests, register plugins via ServiceCollection and call new AuthorityIdentityProviderRegistry(serviceProvider, logger).
• For DPoP-required endpoints, populate security.senderConstraints.dpop.nonce.requiredAudiences or rely on defaults; both now funnel through the normalized set.