Auth Required once their exchanged token expires. The persistent aggregator connection now re-exchanges a fresh token before expiry, and evicts itself only when the subject token can no longer be refreshed.Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.256...v0.0.257
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.255...v0.0.256
Full Changelog: https://github.com/giantswarm/muster/compare/v0.22.1...v0.22.2
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.254...v0.0.255
authentication required / user not authenticated to server errors on tool calls landing in the restart window. (#37060)agents.<name>.m2m block (and the impersonation.yaml / _agent-impersonation.tpl templates it rendered) is removed from agentic-platform-connectivity. Agents no longer get a deputy Role/ClusterRole letting mcp-kubernetes impersonate the agent’s own identity or bind its groups to ClusterRoles. The only supported flow is on-behalf-of: muster mints a token with the human as sub and the agent SA in the RFC 8693 act claim, and the mcp-kubernetes chart’s *-obo-impersonate ClusterRole authorizes impersonating the human. Requires mcp-kubernetes with M2M removed and muster with the matching broker config.Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.253...v0.0.254
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.252...v0.0.253
oauth.server.trustedIssuers[].subjectClaim: sources the canonical subject (the sub of any token minted from the identity) from a claim other than sub. Empty keeps the standard sub. Set it to email for Dex, whose sub is opaque, so an OBO token minted from a Dex subject token carries the user’s email.server.LocalMintExchanger for local RFC 9068 JWT minting; RFC 8693 actor_token validation and act claim support; providers.UserInfo.ActorIssuer/ActorSubject; oidc.IDTokenClaims.Act auto-decoded from act.initSSOForSession rebuilt its detached background context it carried the subject bearer and ID token but dropped the inbound X-Actor-Token, so a bootstrap-established connection minted with no actor (the human subject alone) rather than the agent acting on the human’s behalf. The per-request credential tokens (subject bearer, actor token, ID token) are now carried into the bootstrap context as one unit, so the bootstrap and live-request paths mint identically.email whose email_verified is not true, on both the delegation (X-Actor-Token) path and the no-actor path. Previously the check ran only on the delegation path, so a pre-exchanged subject token already carrying an act chain (a single bearer, no actor header) could mint with an unverified email. A ServiceAccount token, which carries no email, is unaffected.sub=human, act=agent), localMint presents it as the exchange subject and the broker re-binds it to the backend audience, preserving the delegation chain, so the backend sees sub=human, act=agent instead of falling back to the agent ServiceAccount.forwardToken: true (and tokenExchange) MCPServers now work for callers presenting a forwarded ServiceAccount token with no browser auth-code flow. The first request for such a new session connects the session’s SSO backends synchronously before the request’s MCP handler runs, so the caller’s initial tools/list and call_tool succeed instead of returning no tools (auth_required / “authentication context missing, no active session”). Concurrent first requests for the same session are deduplicated.