Nothing to try yetTier: how much it should matter to you
2Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
GatewayArea: what it touches
In DevelopmentKind: in v2.1.228,
What probably matters to youSection of the release
Identity verification runs only when cri.enabled is true in gateway config; the boot path is otherwise unchanged.
What
The gateway gained an optional identity-verification block named cri, with settings for the expected audience, an allowed-organisation list, and the key and issuer URLs used to check tokens. It only runs when cri.enabled is set to true in gateway config; otherwise the boot path is unchanged.
Details
When enabled, the verifier is primed at startup, verified callers are tagged onto upstream requests, and responses for those callers are post-processed.
The gateway reads an x-gateway-upstream-kind header off upstream responses.
OIDC settings became optional, with the group and email claim names defaulting to groups and email.
The two desktop-policy 404 responses now share one error-response helper.
Evidence
x-gateway-upstream-kind
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
