release 1.5.0

Features

• add support for PCRE2 regular expressions in Apache's Require oauth2_claim statements; see OpenIDC/mod_oauth2#39 and https://github.com/zmartzone/mod_oauth2/wiki#authorization

Bugfixes

• fix memory leak in _oauth2_jose_options_jwk_set_rsa_key when using OpenSSL 3.x

Packaging

• depend on libpcre2

release 1.4.5.5

Features

• add support for introspect.params which allows for adding custom POST parameters in the call to the token introspection endpoint; see OpenIDC/mod_oauth2#44

Bugfixes

• hack for el7/x86 where openssl 1.0.2 and openssl 1.1.1 are both co-installed for respectively Apache and NGINX 1.20.1

release 1.4.5.4

Bugfixes

• fix NGINX https schema detection

release 1.4.5.2

Bugfixes

• change Apache module init info log
• initialize check_oauth2 properly; call OPENSSL_init_crypto for OpenSSL >= 1.1.0
• add JANSSON_LIBS to Apache/Nginx LIBADD; closes #40; thanks @pskopnik

Packaging

• add packages for Centos 9, Debian Bookworm and Ubuntu Jammy

release 1.4.5.1

Bugfixes

• fix concurrency issue when using OAuth2Verify metadata; see #37; thanks @rtitle
• fix memory leak in cURL writeback function
• fix memory leak when using OAuth2Verify metadata

release 1.4.5

Bugfixes

• avoid using cjose_jwk_retain because it is not thread safe; see OpenIDC/mod_oauth2#23
• use main request for Apache request contexts
• set refresh to true when getting jwsk_uri results from cache

Features

• print warning when cjose_jws_verify fails

Other

• add cjose, curl and ssl to liboauth2.pc.in
• add add curl and cjose flags to liboauth2_cache_la_CFLAGS

release 1.4.4.2

Bugfixes

• fix file cache so we do not try to remove a file that was cleaned just before; see #33
• fix tests for client_secret_jwt and private_key_jwt so encoded JWT comparison works for cjose >= 0.6.2

release 1.4.4.1

Bugfixes

• fix race condition and potential crash in curl usage in oauth2_url_encode and oauth2_url_decode
  see OpenIDC/mod_oauth2#27; thanks @rtitle

Packaging

• add Debian Bullseye

release 1.4.4

Bugfixes

• hash the cache encryption key to a string instead of bytes:
  avoid crash when using generated key bytes as strings in oauth2_jose_jwk_create_symmetric

Features

• allow deprecated declarations to build with OpenSSL 3.0; see #31

Packaging

• corrected longstanding bug in RPM (devel) dependencies

release 1.4.3.2

bugfixes

• make outgoing_proxy an endpoint property and fix 1.4.3.1
• accommodate for NULL key in oauth2_cache_get and oauth2_cache_set