IdStory Identity Manager

According to https://docs.microsoft.com/en-us/windows-hardware/customize/mobile/mcsf/custom-http-headers-for-internet-explorer, max size of a custom header for Edge is 1k. That's not much :)

• heavily optimize the loading of authorities (this would be nice anyway) and load on each request
• cache authorities on the server
  • requires distributed cache :)
• compress authorities in token with something like LZMA... (ugly)

Tokens and authorities are persisted in database now. I removed authorities from JWT token content => token size was reduced to ~ 500B and will be constant now.
I refactored mechanism with authorization changes to standard logout (~ disable user's token) - when logged user authorities are removed (assigned role was removed or role permission was removed), then users tokens are disabled.
I changed some implementation classes only, api is preserved (see JwtAuthenticationService). I executed tests for OpenAm and PasswordReset module too - they works.

• https://wiki.czechidm.com/devel/documentation/security/dev/authentication
• https://wiki.czechidm.com/devel/documentation/security#authorization_and_jwt_token
• https://wiki.czechidm.com/devel/documentation/security/dev/security#api_endpoints
• https://github.com/bcvsolutions/CzechIdMng/blob/rtomiska/token/CHANGELOG.md

Commit:
https://github.com/bcvsolutions/CzechIdMng/commit/440fa7761ff12fa34d2a59686711240abef8cd22

Could you do a feedback, pls?

I did review and test.

That is awesome feature. I like ability to disable a identity.

• There exists protection interval for generate new token. But that interval works only once after IdmToken item is created. Then is token generated on every request.
• After deletion some item from the IdmToken table works authentication with this token correctly (that is nice). But I expected creation new item in the IdmToken on next request (with 'deleted' token).

• Token is presisted in the IdmToken table now. Token is in the plain text. This can be security issue. I suggest use some hash instead whole token. Maybe not saving the token anymore will be the simplest solution for now.

Thx for feedback, specially for note about persist raw token - it was really dangerous, i didn't realize it. Token hash (sha-1) is saved now only. I fixed all three things above.

Commit: https://github.com/bcvsolutions/CzechIdMng/commit/d3978c41040c88f0c59f61e8f07e36b40a86022a

Could you do a review again please?

I did re-review and re-test.

All three previous comments works nice now. Thanks for that.

I discovered the small issue ... when I used old version of token (totaly unvalid), was user evaluated as "null". All authorities was loaded then (but on end token was evaluated as unvalid ... so this is only performence issue not security).

Thx for feedback, i fixed creating token, when no identity is given:
https://github.com/bcvsolutions/CzechIdMng/commit/a52730a05b635fb03efaec7c12bddff75b896f09