Jans PDP Mesh

Cedarling Requirements

1. Embed PDP Rust Cedar PDP
2. HTTPS SSE: Process notifications of updated Token Status List JWT; validate with Auth Server Public Key
3. Lock Master POST /audit Send telemetry, health and logs to OAuth protected Lock Master endpoint
4. Auth Server POST /register If no client creds are present, generate keys and perform OpenID Dynamic Client Registration (upload JWKS); present SSA JWT if available. Request 24 hour client expiration.
5. Auth Server POST /token Use Client Credential Grant to obtain a JWT access token from Auth Server, needed to call the audit endpoint.
6. GET GIT: On startup and periodically retreive policy updates from Git
7. GET /jwks: On startup and periodically retreive latest Auth Server JWKS keys (to validate JWTs)
8. Future: OpenID AuthZEN API REST interface (alteranative Cedar SDK)

Sequence Diagrams

• API Access Control
• Cedarling Startup
• Simple Authz in Browser App