Ben McClelland 293d9f50d8 fix: deprecations in JWK and IPA RSA handling ...

Go 1.26 marks PKCS#1 v1.5 RSA encryption and direct ECDSA public-key coordinate access
as deprecated. The IPA code path uses rsa.EncryptPKCS1v15 to wrap an AES session key for
vault retrieval, and the OIDC JWKS parser rebuilt EC public keys by setting ecdsa.PublicKey.X
and Y directly.

This change replaces the deprecated RSA wrap with rsa.EncryptOAEP using SHA-256, which is the
standard safe replacement for PKCS#1 v1.5 encryption and preserves the same protocol semantics
for the IPA vault exchange. For EC JWKs, it reconstructs the raw uncompressed public point and
parses it through ecdsa.ParseUncompressedPublicKey, which is the supported Go API for EC public
keys and avoids mutating deprecated fields while preserving the exact mathematical key value.

These changes do not alter the wire protocol or trust decisions; they only migrate to the
supported stdlib APIs for equivalent behavior.

2026-09-08 15:25:08 -07:00

..

iammiddleware

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iamutil

fix: deprecations in JWK and IPA RSA handling

2026-09-08 15:25:08 -07:00