v22.44

CHANGELOG

v22.44

Fix

• Removed client values that are not implemented yet (#91, PLUM Sprint 220923)
• Fix client initialization in provisioning (#101, PLUM Sprint 221021)

Features

• New MongoDB credential provider with configurable queries (#90, PLUM Sprint 220909)
• Client list searches both by _id and client_name (#91, PLUM Sprint 220923)
• Endpoint for ID token validation (#93, PLUM Sprint 220923)
• List tenants and roles for multiple credentials (#94, PLUM Sprint 221007)

Refactoring

• Simplified Admin UI client provisioning setup (#95, PLUM Sprint 221007)

v22.38

v22.38

Compatibility

• seacat-auth-webui v22.38 or higher
• seacat-admin-webui v22.38 or higher
• asab-webui v22.38 or higher

Authentication and authorization in lower versions will not work properly due to the changes in the userinfo endpoint.

Changelog

Breaking changes

• Userinfo endpoint no longer accepts tenant parameter (#69, PLUM Sprint 220909)
• Userinfo resources is now an object with tenant keys (#69, PLUM Sprint 220909)

Fix

• Handle old assignments of nonexisting credentials (#79, PLUM Sprint 220715)
• Check for the existence of tenant when creating a role (#88, PLUM Sprint 220909)

Features

• OpenID Connect client registration (#77, PLUM Sprint 220729)
• Custom credentials data included in userinfo response (#81, PLUM Sprint 220729)

Refactoring

• Provisioning config in a dedicated JSON file (#80, PLUM Sprint 220729)
• Userinfo endpoint no longer accepts tenant parameter (#69, PLUM Sprint 220909)
• Userinfo resources is now an object with tenant keys (#69, PLUM Sprint 220909)

v22.30

Fix

• Remove email and phone requirement from M2M credential creation (#73, PLUM Sprint 220715)
• Fix basic auth for M2M credentials (#74, PLUM Sprint 220715)
• Fixed two-stage build (1b354f2, PLUM Sprint 220715)

Refactoring

• Move password change components into credentials submodule (#75, PLUM Sprint 220715)

v22.28

Fix

• Fix resource check in Batman ELK (#70, PLUM Sprint 220701)

v22.27

Breaking changes

• WebAuthn data format changed: Existing WebAuthn credentials are invalidated (#63, PLUM Sprint 220617)
• External login storage changed: Existing external login credentials are invalidated (#60, PLUM Sprint 220701)

Fix

• Fixed child session filtering (#66, PLUM Sprint 220701)

Refactoring

• Include relaying party ID in WebAuthn storage (#63, PLUM Sprint 220617)
• Dedicated collection for external login credentials (#60, PLUM Sprint 220701)
• Tenant name proposer is not public (#65, PLUM Sprint 220701)
• Session detail includes parent session ID (71f83c0, PLUM Sprint 220701)

v22.26

Breaking changes

• SeaCat API requires authentication with ID token instead of Access token (#39, PLUM Sprint 220520)
• Introspection outputs ID token instead of Access token (#39, PLUM Sprint 220520)
• Roles are no longer included in userinfo or ID token (#50, PLUM Sprint 220603)
• Batman no longer checks role names (#54, PLUM Sprint 220603)
• Public API authenticates by cookie only if no Authorization header is present (#53, PLUM Sprint 220617)

Fix

• Fix TOTP activation error (#43, PLUM Sprint 220520)
• Fix TOTP status in userinfo (#43, PLUM Sprint 220520)
• Session from ID token bug (82d6787, PLUM Sprint 220520)
• OIDC scope format in token response (b5a18c2, PLUM Sprint 220520)
• Always update the expiration of the whole session group (#44, PLUM Sprint 220520)
• Explicit UTC timezone for all time data in userinfo (#45, PLUM Sprint 220520)
• DuplicateError handling (#47, PLUM Sprint 220603)
• Fix delete and touch session (#55, PLUM Sprint 220617)
• Dict credentials creation complies with policy (b7582e5, PLUM Sprint 220617)
• Fix header enrichment in introspection (f4c95cf, PLUM Sprint 220617)
• Fix external login flow (#58, PLUM Sprint 220617)
• Fix role creation and assignment in old tenants (#57, PLUM Sprint 220617)
• Safer session deserialization (#59, PLUM Sprint 220617)
• Handle malformed cookies (1f6b25e, PLUM Sprint 220617)
• Generate new ID token when extending session (#61, PLUM Sprint 220617)
• Fix ID token exchange in cookie introspection (#61, PLUM Sprint 220617)

Features

• Structured session list (#30, PLUM Sprint 220520)
• Authentication with ID token (#39, PLUM Sprint 220520)
• Custom credentials data (#40, PLUM Sprint 220520)
• Ensure credentials contain at least an email or a phone (#41, PLUM Sprint 220520)
• Generic MySQL credentials provider (#42, PLUM Sprint 220603)
• Tenant search filter (#49, PLUM Sprint 220603)

Refactoring

• Authz object no longer contains roles (#50, PLUM Sprint 220603)
• Datetime objects are explicitly UTC-aware (#48, PLUM Sprint 220603)
• RBAC has_resource_access returns boolean (#54, PLUM Sprint 220603)
• Public API authenticates by cookie only if no Authorization header is present (#53, PLUM Sprint 220617)

v22.21

Merge pull request #38 from TeskaLabs/sedoy26-patch-1

Update CHANGELOG.md

v22.16

Release v22.16

v22.10

CHANGELOG

v22.10

Features

• ID token contains JWT-encrypted userinfo data (#13, PLUM Sprint 220225)
• Metrics counting active sessions and credentials per provider added (#9, PLUM Sprint 220225)

Refactoring

• Custom authentication for metrics endpoint (#14, PLUM Sprint 220225)

v22.8

Update CHANGELOG.md