Skip to content

Commit

Permalink
Prepare v0.27.3 (#664)
Browse files Browse the repository at this point in the history
* bump version + deps

* update changelog

* update image tag + rebuild docs

* fix typo in changelog

* update to postgres 17.2 for dev and drop init scripts for easier env vars setup

* bump to stable hiqlite 0.3.3

* bump nightly version

* update changelog and don't return `N/A` name from Github if no family name exists

* bump version + deps

* mention scope update for existing Github IdPs in Changelog
  • Loading branch information
sebadob authored Dec 30, 2024
1 parent f1d138f commit 0b870d5
Show file tree
Hide file tree
Showing 18 changed files with 359 additions and 373 deletions.
18 changes: 16 additions & 2 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Changelog

## UNRELEASED
## v0.27.3

### Changes

Expand All @@ -10,7 +10,7 @@ To provide additional compatibility for some upstream providers like Active Dire
some changes have been applied to Rauthy's behavior.

The first thing is that the HTTP client used for upstream Logins does not force TLS v1.3 anymore, but also allows
TLS v1.2. Both v1.2 and v1.3 are considered being secure by current standards. This is necessary, because some OS'es
TLS v1.2. Both v1.2 and v1.3 are considered being secure by current standards. This is necessary, because some OSes
like Windows Server 2019 do not support TLS 1.3.

The second change is for the way upstream providers are configured. The behavior until now was, that Rauthy added the
Expand All @@ -32,6 +32,20 @@ Even though this changes the request and response objects on the API, this chang
a breaking change. API clients are forbidden to modify upstream IdPs for security reasons, which means this change
should only affect the Rauthy Admin UI.

#### Gitlab as Upstream IdP

Gitlab is special and does its own, annoying thing to make it usable as an upstream IdP. An issue has been found
when someone tries to log in with no publicly shown email address. In this worst case scenario, a successful
login to Github while retrieving all necessary information (email is mandatory for Rauthy), you need to do 3
different API requests.

This version also makes it possible to log in via Github IdP with an account with only private email addresses.
A different `scope` for the login is necessary to make this possible. The template in the UI has been updated,
but this will not affect existing Github IdP Providers. If you are currently using Github as upstream IdP, please
change the `scope` manually from `read:user` to `user:email`.

[#665](https://github.com/sebadob/rauthy/pull/665)

### Bugfix

- During the deletion of a custom scope, that has been mapped to only a clients default scopes, but not the
Expand Down
Loading

0 comments on commit 0b870d5

Please sign in to comment.