Pangolin consults the IdP only at login and keeps its own session
afterwards, so disabling a user or revoking their sessions in the IdP
does not end their Pangolin sessions.
Store the IdP refresh token at OIDC login as a grant and redeem it at
most every server.idp_session_revalidation_minutes (default 5). If the
IdP rejects it with invalid_grant, the grant is marked revoked and all
sessions backed by it and their resource sessions are deleted. Other
errors (IdP unreachable or slower than 10 seconds, invalid_client after
a secret change) keep the sessions valid and are retried after at most
a minute instead of on every request.
Only the instance holding a lease on the grant in the primary database
redeems its refresh token, and it writes the result only while it still
holds the lease, so instances never redeem the same token concurrently.
The per-request lookup reads from a replica through safeRead.
Device logins of the Pangolin clients share the grant of the browser
session that approved them, read from the primary database, so a rotated
refresh token is never redeemed twice by separate sessions.
The Entra ID provider type hardcodes its scopes, so it now requests
offline_access to get a refresh token.
Resolves#1408.
A rule with match "METHOD" carries a comma-separated list of HTTP
methods in its value, e.g. "POST,PUT", and applies when the request
method is in that list. This makes it possible to leave GET public
while sending POST and PUT to auth, which rules could not express
before because both share the same path.
No new columns: the methods live in the existing rule value, so this
needs no migration and every existing rule keeps working unchanged.
The UI offers the ten registered methods. Blueprints and the API
accept any method token, so extension methods such as the WebDAV verbs
can be targeted too, and the UI preserves them when a rule set that
way is edited later.
miloschwartz
Owen
Severin Enzler
TiltedTeapot
Fred KISSIE
Blacks-Army