feat(core): Adds comprehensive DPoP (RFC 9449) support - #3582

Merged

dmihalcik-virtru merged 20 commits into

mainfrom

DSPX-3397-platform-service

Jun 22, 2026

Commits on Jun 22, 2026

feat(platform): add comprehensive DPoP (RFC 9449) support (DSPX-3397)

dmihalcik-virtru
and
claude
committed
feat(platform): add DPoP well-known fields, opentdf-dpop KC client, nonce action input, and KC26 bump (DSPX-3397)

dmihalcik-virtru
and
claude
committed
fix(platform): well-known []string→[]any + KC26 admin-fine-grained-authz

dmihalcik-virtru
and
claude
committed
fix(auth): address DPoP nonce race condition and Connect header propagation

dmihalcik-virtru
and
claude
committed
fix(auth): address DPoP PR review findings

dmihalcik-virtru
and
claude
committed
fix(auth): refactor DPoP nonce manager to use atomic.Pointer and fix empty nonce validation

dmihalcik-virtru
and
claude
committed
feat(auth): warn when DPoP-bound token sent under Bearer scheme

dmihalcik-virtru
and
claude
committed
fixup test static analysis fixes
dmihalcik-virtru
committed
fix(auth): use full URL for DPoP htu validation in ConnectRPC interceptor

dmihalcik-virtru
and
claude
committed
feat(auth): add strict_htu flag to DPoP htu validation

dmihalcik-virtru
and
claude
committed
fix(auth): use actual HTTP method for DPoP htm validation in Connect interceptor
dmihalcik-virtru
committed
chore(auth): add debug logs for DPoP htm value
dmihalcik-virtru
committed
fix(kas): return 403 for routine PDP denials in rewrap
dmihalcik-virtru
committed
fixup: context clarifications
dmihalcik-virtru
committed
test: address PR review comments on DPoP HTU determinism and platform-ref
dmihalcik-virtru
committed
test: keep pinned feat-kc26-dpop tag in start-up action
dmihalcik-virtru
committed
test: gate Keycloak 26.2 behind dpop-challenge-enabled
dmihalcik-virtru
committed
fixup: revert action wrong curl change
dmihalcik-virtru
committed
fixup yaml typo
dmihalcik-virtru
committed
feat(auth): add DPoP jti replay protection and address review comments
dmihalcik-virtru
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(core): Adds comprehensive DPoP (RFC 9449) support - #3582

feat(core): Adds comprehensive DPoP (RFC 9449) support#3582
dmihalcik-virtru merged 20 commits into
mainfrom
DSPX-3397-platform-service

Commits on Jun 22, 2026

feat(platform): add comprehensive DPoP (RFC 9449) support (DSPX-3397)

feat(platform): add DPoP well-known fields, opentdf-dpop KC client, nonce action input, and KC26 bump (DSPX-3397)

fix(platform): well-known []string→[]any + KC26 admin-fine-grained-authz

fix(auth): address DPoP nonce race condition and Connect header propagation

fix(auth): address DPoP PR review findings

fix(auth): refactor DPoP nonce manager to use atomic.Pointer and fix empty nonce validation

feat(auth): warn when DPoP-bound token sent under Bearer scheme

fixup test static analysis fixes

fix(auth): use full URL for DPoP htu validation in ConnectRPC interceptor

feat(auth): add strict_htu flag to DPoP htu validation

fix(auth): use actual HTTP method for DPoP htm validation in Connect interceptor

chore(auth): add debug logs for DPoP htm value

fix(kas): return 403 for routine PDP denials in rewrap

fixup: context clarifications

test: address PR review comments on DPoP HTU determinism and platform-ref

test: keep pinned feat-kc26-dpop tag in start-up action

test: gate Keycloak 26.2 behind dpop-challenge-enabled

fixup: revert action wrong curl change

fixup yaml typo

feat(auth): add DPoP jti replay protection and address review comments