| 9 | Packaging for FenrirOS (spec, syslite unit, container), admin UI for AD objects/DNS/LDIF | |
| 10 | OAuth 2.0 / OpenID Connect provider (plugin oidc) | Issuer per domain <base>/<domain>; discovery, JWKS (RS256), authorize (code + PKCE S256, login page, SSO cookie, prompt=none/login), token (authorization_code, refresh_token with rotation, client_credentials, device_code), device verification page, userinfo, introspection, revocation, end-session; clients with group restriction managed in the admin UI; state in OAuthObject records (replicated, not visible over LDAP/SMB); tested end to end with Authlib |
| 10 | RADIUS server (plugin radius) | UDP 1812/1813: PAP, MS-CHAPv2 with MPPE keys, EAP-PEAPv0/EAP-MSCHAPv2 and EAP-TTLS (PAP, MS-CHAPv2) for WPA-Enterprise/802.1X (in-memory TLS 1.2; TLS 1.3 offers are negotiated down, EAP-TLS/TLS 1.3 keying not planned), EAP fragmentation, Status-Server, accounting (logged); Message-Authenticator required by default (BlastRADIUS); RADIUS clients per domain (address/CIDR, shared secret, allowed groups, VLAN per group via Tunnel-*, groups as Filter-Id/Class) managed in the admin UI as RadiusObject records; config /RADIUS/BIND, AUTHPORT, ACCTPORT, CERT, KEY (default: the SSL certificate); tested with radtest, an independent MS-CHAPv2 client and eapol_test |
