AuthKit-Prov1.0.0
AuthKit-Pro authentication features
Understand AuthKit-Pro JWT sessions, account lifecycle, external identity linking, magic links, passkeys, and security activity.
Updated
JWT and refresh sessions
Password, passkey, OAuth/OIDC, and magic-link success all create an independent AuthSession. Access JWTs are short-lived and include the local subject, user ID, session ID, roles, issuer, audience, issue time, and expiry. Refresh credentials are opaque random values; only SHA-256 digests are stored.
Session controls
The session API identifies the current session and lets an account revoke one owned session, every other session, or all sessions. Logout revokes the family that owns the supplied refresh credential.
Account lifecycle
- Registration is enumeration-safe and starts with an unverified email.
- Verification and recovery credentials are digest-only, purpose-bound, expiring, and single-use.
- Password reset and change revoke sessions and outstanding lifecycle/OTT credentials.
- Email replacement requires the current password and verification at the new address.
- ROLE_ADMIN can disable or enable accounts; re-enable does not restore old sessions or credentials.
OAuth2 and OIDC
Local registration always creates the account. Linking a Google, GitHub, or generic OIDC identity requires a local JWT, browser CSRF, the current password, and a short-lived link intent bound to the selected provider and active session. Later external login resolves the verified issuer/provider and stable subject mapping.
Magic links
Optional magic-link login uses Spring Security One-Time Token generation, JDBC persistence, expiry, consumption, and authentication. AuthKit-Pro adds enabled-account and verified-email eligibility, trusted action-link delivery, and the success bridge to an AuthKit session.
Passkeys
Optional WebAuthn/passkey flows use Spring Security's native DSL and JDBC credential repositories. AuthKit-Pro supplies passkey metadata and converts a successful native authentication into the same AuthKit session/token response used by other login methods.
Security activity
Account-scoped activity records contain event type, time, user ID, and an optional session ID. They do not store passwords, credentials, headers, request bodies, email-link tokens, or provider tokens. Selected events also trigger best-effort notifications after commit.
Explicitly not included
- MFA or TOTP
- SAML or SCIM
- Multi-tenancy
- A complete IAM platform
- Authorization-server functionality
- Persistent brute-force account lockout