hsiegeln 03ff9a3813 feat: generic OIDC role extraction from access token ...

The OIDC login flow now reads roles from the access_token (JWT) in
addition to the id_token. This fixes role extraction with providers
like Logto that put scopes/roles in access tokens rather than id_tokens.

- Add audience and additionalScopes to OidcConfig for RFC 8707 resource
  indicator support and configurable extra scopes
- OidcTokenExchanger decodes access_token with at+jwt-compatible processor,
  falls back to id_token if access_token is opaque or has no roles
- syncOidcRoles preserves existing local roles when OIDC returns none
- SPA includes resource and additionalScopes in authorization requests
- Admin UI exposes new config fields

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-07 10:16:52 +02:00

..

src

feat: generic OIDC role extraction from access token

2026-04-07 10:16:52 +02:00

pom.xml

feat: add server-side ExecutionChunk and FlatProcessorRecord DTOs

2026-03-31 19:02:47 +02:00