Overview

This minor update introduces changes for Authlete 3.0. This new version is available from April 30th (Thu).

New Features & Improvements

Added cleanup queue to client deletion flow in order to minimize impact when working with a large number of entities.

Added the following permissions to Service Access Tokens :

For further details, please consult our documentation.

Implemented capability to set authorization_code_duration at service level.

Updated OID4VCI implementation to include Key Attestation signature verification feature.

Implemented the required validation steps and service properties to support HAIP specification.

Allows OAuth 2.0 Attestation-Based Client Authentication (ABCA) as a client authentication method
When client authentication method is ABCA, will perform additional validation on Client Attestation JWT and Client Attestation PoP JWT
When OpenID for Verifiable Credential Issuance (OID4VCI) is enabled, will verify that the scope parameter includes values referring to credential configurations
Always requires DPoP (RFC 9449 OAuth 2.0 Demonstrating Proof of Possession (DPoP))
For more information on HAIP, documentation is available here

Fixed an issue where a request missing a request body would result in an empty 400 error.

N/A