6a299d231f
- Implemented tests for RouterConfig, RoutingOptions, StaticInstanceConfig, and RouterConfigOptions to ensure default values are set correctly. - Added tests for RouterConfigProvider to validate configurations and ensure defaults are returned when no file is specified. - Created tests for ConfigValidationResult to check success and error scenarios. - Developed tests for ServiceCollectionExtensions to verify service registration for RouterConfig. - Introduced UdpTransportTests to validate serialization, connection, request-response, and error handling in UDP transport. - Added scripts for signing authority gaps and hashing DevPortal SDK snippets.
1.6 KiB
1.6 KiB
Authority Binding Matrix (DPoP / mTLS) — AU2/AU3
All values deterministic and sorted by flow, tenant, environment.
Enforcement Matrix
| Flow | Tenant scope required | Binding | Nonce policy | Audience rules | Notes |
|---|---|---|---|---|---|
| device_code | tenant required; env optional | DPoP (ECDSA P-256) | nonce TTL 120s; single-use; clock skew ±30s | aud must match service; reject wildcard |
Offline: tokens minted against cached JWKS; nonce list capped 1024 entries |
| auth_code | tenant required; env required | mTLS (SPIFFE) | n/a (channel bound) | aud == service; azp == client; enforce PKCE |
Supports delegated authz; cert SAN must match client_id |
| client_credentials | tenant required; env optional | DPoP (Ed25519) or mTLS | nonce TTL 300s; rotate per token | aud == service; forbid multi-audience |
Use mTLS when hardware root is available; else DPoP fallback |
DPoP Requirements
- Proof
htu/htmmust match request; reject if clock skew >30s. - JTI single-use; store for nonce TTL window; evict oldest on cap.
- Accept curves: P-256, Ed25519; forbid P-384/521 until crypto profile registry marks active.
mTLS Requirements
- Client cert must chain to approved trust roots per tenant.
- SAN must include
urn:stellaops:client:{client_id}. - Require OCSP/CRL freshness ≤10m (offline mode: last good CRL/OCSP cached and timestamped).
Negative-path examples
- Reject DPoP without nonce; reject reuse within TTL.
- Reject auth_code where
audcontains wildcard or mismatched service. - Reject client_credentials with missing tenant claim or multi-audience list.