feat: RFC 8705 mutual-TLS client authentication for CF app instance identity - #3972

Open

rkoster wants to merge 132 commits into

cloudfoundry:developfrom

rkoster:feat/rfc8705-mtls-client-auth

Commits on Aug 18, 2026

feat(model): add tls_client_auth constant and logic to ClientAuthentication
rkoster
committed
fe24edc
feat(model): add CLIENT_AUTH_TLS_CLIENT_AUTH to TokenConstants
rkoster
committed
91f18c9
feat(model): add TlsClientAuthConfiguration model class
rkoster
committed
8d21fd4
feat(model): add tlsClientAuthConfiguration field to UaaClientDetails
rkoster
committed
7649861
fix(model): add equals/hashCode to TlsClientAuthConfiguration and ClaimMapping
rkoster
committed
95a01db
feat(model): add mtls_endpoint_aliases and tls_client_auth to OpenIdConfiguration
rkoster
committed
5f18709
feat(server): add java-buildpack-client-certificate-mapper-jakarta dependency
rkoster
committed
95fc065
feat(server): register ClientCertificateMapper filter for /oauth/mtls/*
rkoster
committed
f883780
feat(server): add TlsClientAuthentication cert chain validation service
rkoster
committed
ca390e3
feat(server): add isTlsClientAuth / validateTlsClientAuth to ClientDetailsAuthenticationProvider
rkoster
committed
ee6201f
fix(server): deserialize TlsClientAuthConfiguration from additionalInformation Map
rkoster
committed
b0c3b20
feat(server): allow tls_client_auth in ClientCredentialsTokenGranter
rkoster
committed
5443718
feat(server): add MtlsClaimsEnhancer UaaTokenEnhancer for cert-derived JWT claims
rkoster
committed
446a8a3
feat(server): add mtls_endpoint_aliases to OIDC discovery document
rkoster
committed
fa226ea
Fix @Value key in OpenIdConnectEndpoints to match ERB-emitted mtls.endpoint
rkoster
committed
40515e5
fix(server): add OAUTH_11 order constant and dedicated mTLS security filter chain
rkoster
committed
3964568
fix(server): handle flat String PEM in getTlsClientAuthConfiguration; expose /oauth/mtls/token
rkoster
committed
f954da6
fix(server): fix MtlsClaimsEnhancer for DB-loaded clients and Diego multi-valued RDNs
rkoster
committed
0ed40d4
fix(review): address PR feedback on mTLS client auth
rkoster
committed
08da0cd
test: update OIDC discovery tests for mtls_endpoint_aliases and tls_client_auth
rkoster
committed
e038d5d
fix(review): fix JsonProperty collision and support full cert chain in mTLS auth
rkoster
committed
c9be2f0
test: update tlsClientAuthConfigRoundTripsViaJson for @JsonIgnore design
rkoster
committed
901e4f8
feat: add subTemplate and audTemplates to TlsClientAuthConfiguration
rkoster
committed
ad24fe6
test: fix audTemplates equality isolation in TlsClientAuthConfigurationTest
rkoster
committed
04a3dfd
refactor: restructure enhance() into phase 1/2 (vars + dot-notation)
rkoster
committed
66d8173
fix: document single-level nesting, add conflict test, restore comment
rkoster
committed
14f4eca
feat: add phase 3 sub/aud template rendering to MtlsClaimsEnhancer
rkoster
committed
16d366a
fix: static PLACEHOLDER pattern, StringBuilder, restore comment, rename test
rkoster
committed
70a03f6
feat: read tls-client-auth-sub-template and aud-templates from flat BOSH String path
rkoster
committed
f4fcdb0
fix: apply token enhancer overrides after UAA defaults so sub/aud templates win
rkoster
committed
e94d338
fix(review): isValidMethod accepts null method with CA-only config
rkoster
committed
046f03d
fix(review): use LdapName for RFC 2253-safe DN parsing in MtlsClaimsEnhancer
rkoster
committed
553992d
test(review): confirm PKIX validation tolerates trust anchor in presented chain
rkoster
committed
73483c5
fix(review): run ClientCertificateMapper filter before Spring Security
rkoster
committed
afc8801
fix(review): require tls_client_auth before deriving mTLS claims
rkoster
committed
36f1f57

Commits on Aug 19, 2026

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 24, 2026

Commits on Aug 26, 2026

fix(review): keep outbound IdP auth methods separate from inbound tls_client_auth
rkoster
committed
b31e33f
fix(review): reject tls client auth in code exchange
rkoster
committed
d0a0497
fix(review): derive inbound mTLS solely from tls-client-auth-ca and fixed path
rkoster
committed
b13db7c
test(review): make mTLS docs client secretless
rkoster
committed
36aa21f
fix(review): persist secretless mTLS docs client
rkoster
committed
cc5bf5d
fix(review): clear persisted mTLS docs client secret
rkoster
committed
67f7cf2
refactor(review): remove unused mTLS docs client binding
rkoster
committed
8ebd5eb
docs: document CA-only inbound mTLS selection
rkoster
committed
3b889d4
fix: reject blank CA for secretless zone clients
rkoster
committed
be41a4e
fix: narrow mTLS token endpoint boundary
rkoster
committed
0a194a1
docs: correct mTLS configuration references
rkoster
committed
e524955

Commits on Aug 27, 2026

docs(review): render a TLS-capable mTLS curl and align client-auth selector docs
rkoster
committed
d479e85

Commits on Aug 28, 2026

fix(review): normalize mTLS CA representations for zone clients
rkoster
committed
b8cc7bb
fix(review): handle null zone client additional information
rkoster
committed
47d9d72
fix(review): validate nested zone mTLS claim configuration
rkoster
committed
8899760
fix(review): validate nested zone mTLS configuration
rkoster
committed
6967990
fix(review): fail closed for nested mTLS configuration
rkoster
committed
eaafe83
Merge remote-tracking branch 'origin/develop' into feat/rfc8705-mtls-client-auth
rkoster
committed
b912c12
docs(review): align mTLS examples with JWT federation
rkoster
committed
34581fd
docs(review): retain opaque auth code example
rkoster
committed
7abdc26
fix: extract all OU values from multi-valued RDNs
rkoster
committed
316de20

Commits on Aug 31, 2026

docs(review): verify mTLS JWT certificate binding
rkoster
committed
e902aef
docs(review): render required mTLS client ID
rkoster
committed
86174f3
fix(review): validate mTLS properties without mappings
rkoster
committed
d3a2bda
fix(review): validate trusted proxy CA
rkoster
committed
1e83ee7
test: remove invalid trusted proxy CA fixture
rkoster
committed
bb516a8
fix(review): validate configured client auth CA
rkoster
committed
db63eeb
test: use valid client auth CA in bootstrap tests
rkoster
committed
78e348f

Commits on Sep 1, 2026

Commits on Sep 4, 2026

test: reject expired mTLS client certificates
rkoster
committed
471ad57