Security-dependency release on top of 2.4.0-rc.17. Dependency fix cel-go bumped 0.28.1 → v0.29.2, clearing GHSA-gcjh-h69q-9w9g (CVSS 6.3, affects >=0.22.0,<=0.28.1). It reached us transitively through openfga. The advisory: ext.NativeTypes(ParseStructTag("json")) does not honour JSON's skip directive, so a field tagged json:"-" becomes readable through a CEL expression as dyn(obj)["-"]. This was a…
Follows 2.4.0-rc.16 with one security fix that missed that build. Email verification: one decision core, and empty-subject tokens refused (#755) The GraphQL and REST verify-email paths had drifted apart twice, each time because the same decision was implemented in two places. The second drift is the one users hit: a verification click that landed on the MFA setup screen returned before email_verif…
First RC containing the full 2.4.0 pre-release security audit. rc.15 was tagged but never produced an image — its build was cancelled, and it was cut from a commit predating the audit work — so this is the first usable RC of that work. Security The 22-finding pre-release audit (#748, #751) and the phone-only account fixes (#753). Highlights: nOAuth defense — a social login whose provider does not…
Breaking change — --encryption-key At-rest encryption no longer silently derives from --jwt-secret. A deployment using an asymmetric JWT algorithm (RS*/ES*) with no --jwt-secret will refuse to start until --encryption-key is set. HMAC deployments (HS256/HS384/HS512) are unaffected — the key still falls back to --jwt-secret. ./authorizer \ --jwt-type=RS256 \ --jwt-private-key="$(cat jwt-private.pem…
What's Changed fix: MFA enrolment state in settings + OAuth provider contract audit by @lakhansamani in #740 Full Changelog: 2.4.0-rc.13...2.4.0-rc.14
What's Changed security(e2e): warn at startup when --env=e2e is set by @lakhansamani in #732 test(e2e-playground): live-playground e2e suite for OIDC/SAML/SCIM/SSO/OAuth/MFA by @lakhansamani in #729 fix(security): make single-use token primitives atomic by @lakhansamani in #736 fix(e2e): rebuild images so the suite tests current source by @lakhansamani in #738 docs: neutralise vendor comparisons i…
What's Changed security(deps): bump google.golang.org/grpc to v1.82.1 (GO-2026-6061) by @lakhansamani in #734 chore(web/app): bump authorizer-react to 2.2.0-rc.5 by @lakhansamani in #735 Full Changelog: 2.4.0-rc.11...2.4.0-rc.12
What's Changed fix(storage): mongodb unique-index batch + thread ctx through SQL GORM calls by @lakhansamani in #733 Full Changelog: 2.4.0-rc.10...2.4.0-rc.11
What's Changed fix(dashboard): add SCIM/group events to webhook event dropdown by @lakhansamani in #724 chore(web/app): bump authorizer-react to 2.2.0-rc.3 by @lakhansamani in #725 chore(proto): regenerate stale client-SDK proto stubs + add CI staleness gate by @lakhansamani in #726 fix(web/app): wire hasSmsOtp so WebOTP auto-fill actually activates by @lakhansamani in #727 chore(proto): drop vend…
Bug fixes GraphQL pagination schema standardized on a single-level shape (BREAKING). 6 List*Request input types (ListClients, ListTrustedIssuers, ListSAMLServiceProviders, ListOrganizations, ListOrgDomains, ListOrgMembers) and 3 operations (_verification_requests, _webhooks, _email_templates) required a PaginatedRequest wrapper (pagination: { pagination: { limit, page } }) that never existed on th…
What's Changed fix(saml): resume SP-initiated IdP login after login, unblock ACS auto-submit by @lakhansamani in #713 Full Changelog: 2.4.0-rc.7...2.4.0-rc.8
Security MFA session-purpose scoping. Several MFA-adjacent flows shared one bare "does an MFA session exist for this user" check without distinguishing why that session was minted, letting a session obtained for one purpose be redeemed for a stronger one: Added a distinct password_reset MFA-session purpose (alongside the existing verified/challenge), minted only by ForgotPassword's mobile OTP leg.…
Security Critical: signup could bypass MFA enforcement entirely. SignUpRequest.is_multi_factor_auth_enabled — a field intended only for the authenticated admin _update_user override — was also honored on the public, unauthenticated signup mutation/RPC, letting a caller decide whether MFA applied to the account they were creating. This was confirmed live and reproducible in 2.4.0-rc.0 through rc.5:…
Highlights Observability hardening across auth, FGA, and OAuth 2.1 rejection paths (#709) — a systematic pass closing silent failure/rejection points found by auditing every code path touched by the recent SCIM/FGA/SAML/OAuth-hardening/async work, verified through independent security, Go-idiom, Prometheus, and principal-engineer review passes before merge. OAuth 2.1/RFC 8707 rejection branches in…
Highlights OAuth 2.1 authorization-server hardening for MCP (#693, closes #516) — Authorizer's /oauth/token and /authorize now support what the current MCP authorization spec actually asks of an AS, scoped against the real spec text rather than an older draft. Refresh-token reuse detection (OAuth 2.1 §6.1 / RFC 9700 §4.14.2), scoped to the specific compromised token's rotation lineage (family_id)…
Highlights SAML 2.0 Identity Provider role (#691) — Authorizer can now act as a SAML IdP, issuing signed assertions to downstream SaaS Service Providers (Zendesk, Notion, Tableau, …), the inverse of the existing SP role. Per-org IdP metadata, SP-initiated and IdP-initiated SSO, RSA-SHA256 signed assertions with configurable NameID + attribute mapping. X.509 signing keys with overlap-window rotatio…
What's Changed chore(app): regenerate package-lock.json for authorizer-react git dep by @lakhansamani in #689 fix(app): pin authorizer-react to the published npm release, not main by @lakhansamani in #690 Full Changelog: 2.4.0-rc.1...2.4.0-rc.2
What's Changed test: fix make test-all-db TempDir cleanup race by @lakhansamani in #677 feat: server-side user search + user org membership in dashboard by @lakhansamani in #678 chore: fix js vulnerability (bump vitest, refresh lockfiles) by @lakhansamani in #683 feat(mfa)!: enable MFA by default and make it optional by @lakhansamani in #682 fix: search users by ID + show member email in org lists…
RC for e2e testing — 2.4.0 line (all new features ship under 2.4.0 going forward). Full-stack RC: everything in 2.3.0-rc.10 (multi-tenant SSO epic, WebAuthn/passkey backend, TOTP lockout + recovery-code hashing, OAuth discovery cache + Twitter PKCE, sync password-reset revocation) plus the login UI: the bundled hosted login page (web/app) now ships passkey login and the non-dismissible TOTP-lockou…
RC for e2e testing — phase 1 (backend). Ships everything merged since 2.3.0-rc.9: the multi-tenant SSO epic (org-scoped admin, verified domains, home realm discovery), WebAuthn/passkey backend, TOTP lockout + recovery-code hashing, OAuth discovery cache + Twitter PKCE fix, and synchronous password-reset session revocation. Note: the login UI (web/app) still bundles authorizer-react 2.1.0 here — th…
What's Changed feat: Fine-Grained Authorization with Keycloak-Core Policy Engine by @lakhansamani in #607 chore(authz): consistent authz prefix on admin GraphQL ops; my_permissions → permissions by @lakhansamani in #610 Chore/authz graphql naming consistency by @lakhansamani in #611 chore: CNCF Sandbox prep — community files + Apache-2.0 relicense by @lakhansamani in #612 chore: use quay for docke…
What's Changed ci: bump GitHub Actions to Node 24 runtimes by @lakhansamani in #633 build(docker): expose gRPC port 9091 by @lakhansamani in #634 feat(api)!: serve all auth ops on gRPC/REST + flatten response envelope by @lakhansamani in #635 Full Changelog: 2.3.0-rc.8...2.3.0-rc.9
What's Changed feat(api): AuthorizerAdmin service (gRPC + REST) + module-wide lint gate by @lakhansamani in #631 Full Changelog: 2.3.0-rc.7...2.3.0-rc.8
What's Changed fix(storage): silence GORM logger in legacy-uniqueness cleanup (fixes smoke mcp_stdio) by @lakhansamani in #632 Full Changelog: 2.3.0-rc.6...2.3.0-rc.7
What's Changed ci: avoid duplicate workflow runs across PR and merge by @lakhansamani in #630 fix(storage): clear legacy unique email/phone objects name-agnostically (< 2.3.0 upgrades) by @lakhansamani in #629 Full Changelog: 2.3.0-rc.5...2.3.0-rc.6
What's Changed ci: publish proto schema to the Buf Schema Registry by @lakhansamani in #627 fix(storage): drop stale unique email/phone constraints on upgrade by @lakhansamani in #628 Full Changelog: 2.3.0-rc.4...2.3.0-rc.5
Full Changelog: 2.3.0-rc.3...2.3.0-rc.4
Full Changelog: 2.3.0-rc.2...2.3.0-rc.3
What's Changed fix: trigger scorecard on default branch events, not releases by @lakhansamani in #624 feat(authz): replace bespoke FGA with embedded OpenFGA ReBAC engine by @lakhansamani in #625 Full Changelog: 2.3.0-rc.1...2.3.0-rc.2
What's Changed feat: Fine-Grained Authorization with Keycloak-Core Policy Engine by @lakhansamani in #607 chore(authz): consistent authz prefix on admin GraphQL ops; my_permissions → permissions by @lakhansamani in #610 Chore/authz graphql naming consistency by @lakhansamani in #611 chore: CNCF Sandbox prep — community files + Apache-2.0 relicense by @lakhansamani in #612 chore: use quay for docke…