v3.3.0

• [new] Support custom HTTP header for access token through the customAccessTokenHeader configuration option.

v3.2.0

• [fix] Properly process array claims for roles and permissions additional claims.
• [fix] Respond with 401 HTTP code instead of 403 when access token is not present or invalid.
• [fix] Avoid error 500 due to double response when access token is invalid.
• [chg] Additional roles or permissions claims are now processed regardless of the treatScopeAsRoles config value.
• [new] New config option discloseUnauthorizedReason controls if the reason of code 401 is disclosed to the client or not.

v3.1.0

• [new] Config option additionalRolesClaim enable gathering additional roles from a custom claim.
• [new] Config option additionalPermissionsClaim enable gathering additional permissions from a custom claim.
• [chg] Better token validation error messages.

v3.0.0

• [brk] Moved everything under the org.seedstack.oauth.spi package to org.seedstack.oauth.
• [chg] The application id is now used as the default allowed audience if none is configured.
• [chg] Raw user info is available as implementation-specific subject principal of type com.nimbusds.openid.connect.sdk.claims.UserInfo.
• [chg] Raw tokens are available as org.seedstack.oauth.OAuthAuthenticationToken subject principal.

v2.0.0

• [brk] Simplified and new configuration options.
• [new] A default opaque token validator is now provided (validating the access token by calling the userInfo endpoint if available).
• [new] Improved token validation (at_hash optional, try validating access token as JWT first, then as an opaque token if it fails).
• [new] Allow treating scopes either as direct permissions (the default) or as roles (which then can give permissions through a RolePermissionResolver).
• [new] Extract claims from ID token if available and enrich them with the userInfo endpoint if enabled (off by default).
• [new] Proper support for bearer access tokens.
• [chg] Improved client error messages.

v1.1.2

• [fix] Force json-smart transitive dependency to use a fixed version instead of a range, which can break build.

v1.1.1

• [chg] Updated OAuth2 SDK

v1.1.0

• [new] OAuthRealm now provides subject roles based on OAuth scopes.
• [new] UserInfo data is now available as a subject principal.
• [new] Client credentials flow is now supported.

v1.0.0

• [new] Initial version.