Security release. Fixes two reported advisories plus two further issues of the same classes found while fixing them. Upgrading from 2.4.0 is recommended for every deployment. Read the migration note below first — it affects anyone running behind a reverse proxy. Security fixes Issue Severity Affected Admin-secret brute-force lockout bypass via spoofable client IP (GHSA-93hc-xq3w-xw87) Critical >=…
Enterprise SSO (SAML IdP, verified domains, home realm discovery), WebAuthn/passkey login, SCIM 2.0, machine and agent identity (client_credentials, RFC 7523 workload identity, RFC 8693 delegation), a remote MCP server, gRPC and REST alongside GraphQL, and an OpenFGA-backed authorization engine. Breaking: --url is now required, the at-rest encryption key is split out as --encryption-key, MFA is on…
Release candidate for 2.4.0. Since 2.4.0-rc.22 Security A logged-out subject can no longer seed new delegations (#776) — token exchange verified a subject_token's signature, issuer and type and nothing else. The resulting delegated token is bound to a third-party resource and validated by that server, which has no view of this session store, so after a logout the user's agent kept minting fresh, e…
Release candidate for 2.4.0. Since 2.4.0-rc.21 Go 1.26.6 (#772) — go.mod is the single source of truth; every workflow resolves the toolchain from it and the image tracks golang:1.26-alpine3.23. --url added to every runnable command in the repo (#771) — the README (including the Docker quick start and the volume-persistence example), MIGRATION.md, the perf harness and .env.sample all documented co…
Release candidate for 2.4.0. Since 2.4.0-rc.20 authorizer mcp now honours --url. The subcommand inherits the root flag set, so --url was always accepted there, but parsers.SetTrustedURL was only called from the server's startup path — so it silently did nothing and issuer validation stayed on header derivation (#768). --mcp-authorizer-url is deprecated and inert. Pass --url with the same value. St…
Security release on top of 2.4.0-rc.19. Upgrading from rc.19 or earlier requires one configuration change — see Breaking change below. This release closes four vulnerabilities found by verifying a backlog of community-reported security advisories. All four were confirmed live on main with a reproducing test before being fixed. ⚠️ Breaking change: --url is now required Authorizer will refuse to sta…
Security and feature release on top of 2.4.0-rc.18. Security fixes Social-login state injection (#760). The state carried four values through the provider round trip joined by ___, and the first of them was supplied by the caller. A caller whose state contained the delimiter shifted every later field left, so state=A___https://evil.example___admin___openid made the callback read its redirect URI f…
Security-dependency release on top of 2.4.0-rc.17. Dependency fix cel-go bumped 0.28.1 → v0.29.2, clearing GHSA-gcjh-h69q-9w9g (CVSS 6.3, affects >=0.22.0,<=0.28.1). It reached us transitively through openfga. The advisory: ext.NativeTypes(ParseStructTag("json")) does not honour JSON's skip directive, so a field tagged json:"-" becomes readable through a CEL expression as dyn(obj)["-"]. This was a…
Follows 2.4.0-rc.16 with one security fix that missed that build. Email verification: one decision core, and empty-subject tokens refused (#755) The GraphQL and REST verify-email paths had drifted apart twice, each time because the same decision was implemented in two places. The second drift is the one users hit: a verification click that landed on the MFA setup screen returned before email_verif…
First RC containing the full 2.4.0 pre-release security audit. rc.15 was tagged but never produced an image — its build was cancelled, and it was cut from a commit predating the audit work — so this is the first usable RC of that work. Security The 22-finding pre-release audit (#748, #751) and the phone-only account fixes (#753). Highlights: nOAuth defense — a social login whose provider does not…
Breaking change — --encryption-key At-rest encryption no longer silently derives from --jwt-secret. A deployment using an asymmetric JWT algorithm (RS*/ES*) with no --jwt-secret will refuse to start until --encryption-key is set. HMAC deployments (HS256/HS384/HS512) are unaffected — the key still falls back to --jwt-secret. ./authorizer \ --jwt-type=RS256 \ --jwt-private-key="$(cat jwt-private.pem…
What's Changed fix: MFA enrolment state in settings + OAuth provider contract audit by @lakhansamani in #740 Full Changelog: 2.4.0-rc.13...2.4.0-rc.14
What's Changed security(e2e): warn at startup when --env=e2e is set by @lakhansamani in #732 test(e2e-playground): live-playground e2e suite for OIDC/SAML/SCIM/SSO/OAuth/MFA by @lakhansamani in #729 fix(security): make single-use token primitives atomic by @lakhansamani in #736 fix(e2e): rebuild images so the suite tests current source by @lakhansamani in #738 docs: neutralise vendor comparisons i…
What's Changed security(deps): bump google.golang.org/grpc to v1.82.1 (GO-2026-6061) by @lakhansamani in #734 chore(web/app): bump authorizer-react to 2.2.0-rc.5 by @lakhansamani in #735 Full Changelog: 2.4.0-rc.11...2.4.0-rc.12
What's Changed fix(storage): mongodb unique-index batch + thread ctx through SQL GORM calls by @lakhansamani in #733 Full Changelog: 2.4.0-rc.10...2.4.0-rc.11
What's Changed fix(dashboard): add SCIM/group events to webhook event dropdown by @lakhansamani in #724 chore(web/app): bump authorizer-react to 2.2.0-rc.3 by @lakhansamani in #725 chore(proto): regenerate stale client-SDK proto stubs + add CI staleness gate by @lakhansamani in #726 fix(web/app): wire hasSmsOtp so WebOTP auto-fill actually activates by @lakhansamani in #727 chore(proto): drop vend…
Bug fixes GraphQL pagination schema standardized on a single-level shape (BREAKING). 6 List*Request input types (ListClients, ListTrustedIssuers, ListSAMLServiceProviders, ListOrganizations, ListOrgDomains, ListOrgMembers) and 3 operations (_verification_requests, _webhooks, _email_templates) required a PaginatedRequest wrapper (pagination: { pagination: { limit, page } }) that never existed on th…
What's Changed fix(saml): resume SP-initiated IdP login after login, unblock ACS auto-submit by @lakhansamani in #713 Full Changelog: 2.4.0-rc.7...2.4.0-rc.8
Security MFA session-purpose scoping. Several MFA-adjacent flows shared one bare "does an MFA session exist for this user" check without distinguishing why that session was minted, letting a session obtained for one purpose be redeemed for a stronger one: Added a distinct password_reset MFA-session purpose (alongside the existing verified/challenge), minted only by ForgotPassword's mobile OTP leg.…
Security Critical: signup could bypass MFA enforcement entirely. SignUpRequest.is_multi_factor_auth_enabled — a field intended only for the authenticated admin _update_user override — was also honored on the public, unauthenticated signup mutation/RPC, letting a caller decide whether MFA applied to the account they were creating. This was confirmed live and reproducible in 2.4.0-rc.0 through rc.5:…
Highlights Observability hardening across auth, FGA, and OAuth 2.1 rejection paths (#709) — a systematic pass closing silent failure/rejection points found by auditing every code path touched by the recent SCIM/FGA/SAML/OAuth-hardening/async work, verified through independent security, Go-idiom, Prometheus, and principal-engineer review passes before merge. OAuth 2.1/RFC 8707 rejection branches in…
Highlights OAuth 2.1 authorization-server hardening for MCP (#693, closes #516) — Authorizer's /oauth/token and /authorize now support what the current MCP authorization spec actually asks of an AS, scoped against the real spec text rather than an older draft. Refresh-token reuse detection (OAuth 2.1 §6.1 / RFC 9700 §4.14.2), scoped to the specific compromised token's rotation lineage (family_id)…
Highlights SAML 2.0 Identity Provider role (#691) — Authorizer can now act as a SAML IdP, issuing signed assertions to downstream SaaS Service Providers (Zendesk, Notion, Tableau, …), the inverse of the existing SP role. Per-org IdP metadata, SP-initiated and IdP-initiated SSO, RSA-SHA256 signed assertions with configurable NameID + attribute mapping. X.509 signing keys with overlap-window rotatio…
What's Changed chore(app): regenerate package-lock.json for authorizer-react git dep by @lakhansamani in #689 fix(app): pin authorizer-react to the published npm release, not main by @lakhansamani in #690 Full Changelog: 2.4.0-rc.1...2.4.0-rc.2
What's Changed test: fix make test-all-db TempDir cleanup race by @lakhansamani in #677 feat: server-side user search + user org membership in dashboard by @lakhansamani in #678 chore: fix js vulnerability (bump vitest, refresh lockfiles) by @lakhansamani in #683 feat(mfa)!: enable MFA by default and make it optional by @lakhansamani in #682 fix: search users by ID + show member email in org lists…
RC for e2e testing — 2.4.0 line (all new features ship under 2.4.0 going forward). Full-stack RC: everything in 2.3.0-rc.10 (multi-tenant SSO epic, WebAuthn/passkey backend, TOTP lockout + recovery-code hashing, OAuth discovery cache + Twitter PKCE, sync password-reset revocation) plus the login UI: the bundled hosted login page (web/app) now ships passkey login and the non-dismissible TOTP-lockou…
RC for e2e testing — phase 1 (backend). Ships everything merged since 2.3.0-rc.9: the multi-tenant SSO epic (org-scoped admin, verified domains, home realm discovery), WebAuthn/passkey backend, TOTP lockout + recovery-code hashing, OAuth discovery cache + Twitter PKCE fix, and synchronous password-reset session revocation. Note: the login UI (web/app) still bundles authorizer-react 2.1.0 here — th…
What's Changed feat: Fine-Grained Authorization with Keycloak-Core Policy Engine by @lakhansamani in #607 chore(authz): consistent authz prefix on admin GraphQL ops; my_permissions → permissions by @lakhansamani in #610 Chore/authz graphql naming consistency by @lakhansamani in #611 chore: CNCF Sandbox prep — community files + Apache-2.0 relicense by @lakhansamani in #612 chore: use quay for docke…
What's Changed ci: bump GitHub Actions to Node 24 runtimes by @lakhansamani in #633 build(docker): expose gRPC port 9091 by @lakhansamani in #634 feat(api)!: serve all auth ops on gRPC/REST + flatten response envelope by @lakhansamani in #635 Full Changelog: 2.3.0-rc.8...2.3.0-rc.9
What's Changed feat(api): AuthorizerAdmin service (gRPC + REST) + module-wide lint gate by @lakhansamani in #631 Full Changelog: 2.3.0-rc.7...2.3.0-rc.8