v1.7.2 - Least-privilege cross-forest OU delegation

Security

• Set-CrossForestOuDelegation.ps1 now grants only Microsoft's least-privilege
  domain-join permission set on descendant computer objects instead of the broad
  Write all properties right. The delegated writes are scoped to Validated
  write to DNS host name, Validated write to servicePrincipalName and Write
  Account Restrictions (userAccountControl), plus the existing Reset Password
  extended right and Create Child: computer on the OU. Verified end-to-end in a
  cross-forest test environment.

Full changelog: v1.7.1...v1.7.2

v1.7.1 - Web UI sign-in banner only on rejected login

Fixed

• Web UI login: the red "Sign-in failed" banner no longer appears on the
  first /ui visit or right after signing out. Pode reuses the auth
  FailureUrl for every unauthenticated redirect (first visit, logout and
  rejected login), so the previous ?failed=1 query flag lit the banner in all
  three cases. The banner is now driven by Pode's auth-error flash message,
  which is set only when an actual login POST is rejected - i.e. only for a wrong
  user name or password.

Full changelog: v1.7.0...v1.7.1

v1.7.0 - Web UI sign-out button + API-key management docs

Added

• Web UI: a Sign out button on the form and result pages that ends the
  server-side session (POST <BasePath>/logout), shown only in
  WebUi.AuthMode = 'WindowsAd' (standalone) mode. New Get-OdjLogoutForm
  builder plus a -ShowLogout switch on Get-OdjFormBody / Get-OdjResultBody,
  wired up from the /ui, provision-error and result render sites.
• tests/Unit/OfflineJoinWebUi.Tests.ps1: coverage for Get-OdjLogoutForm and
  the conditional logout button on the form and result pages.

Changed

• docs/quickstart.md, docs/schnellstart.md: new Managing and rotating API
  keys section (one-way SHA-256 hashing, the caller keeps the clear-text key,
  adding vs. rotating clients, and the warning that re-running install.ps1
  overwrites the whole ApiClients block). Documented the Web UI Sign out
  button in the security model (standalone mode only; IIS/SSO handles sign-out
  otherwise).

Full changelog: v1.6.11...v1.7.0

v1.6.11

v1.6.11 — Documentation release

Documentation-only release (no code changes).

Changed

• Multiple API clients on the REST endpoint — clarified in docs/quickstart.md
  and docs/schnellstart.md that ApiClients is an array: the presented
  X-Api-Key is matched against every entry, so any number of clients can be
  authorised side by side (the matched Name is written to the audit log). Added
  a concrete multi-client example and a note that install.ps1 only writes the
  first client — further callers are added by editing the ApiClients array
  in appsettings.psd1 directly (one SHA256 hash per key).

v1.6.10

v1.6.10 — Documentation release

Documentation-only release (no code changes).

Added

• Multi-cloud IaC guide — docs/multi-cloud.md (DE) and docs/multi-cloud.en.md (EN):
  how to drive the web service from Bicep, Terraform and Ansible to offline-domain-join
  multi-cloud Windows VMs (Azure, AWS, GCP), with Mermaid diagrams and end-to-end samples.
  Linked from the READMEs and the docs index.
• WebUi configuration reference — the settings-reference table in docs/quickstart.md
  and docs/schnellstart.md now documents the full WebUi block: WebUi.Enabled,
  WebUi.AuthMode ('WindowsAd' standalone with a hosted Add-PodeAuthWindowsAd login form +
  session cookie, or 'IIS'), WebUi.AdminGroup and WebUi.BasePath.

Fixed

• Restored the missing CHANGELOG compare links for v1.6.6–v1.6.9.

v1.6.9

v1.6.9

Added

• Web UI result page now has a Download button next to the provisioning
  data. It saves the generated payload as a file entirely client-side (no extra
  server round-trip): a Base64 blob downloads as <computername>.txt and an
  unattend XML fragment downloads as <computername>-unattend.xml.
• Docs (quickstart.md, schnellstart.md): expanded the apply step into an
  apply-and-verify walkthrough covering the downloaded blob file
  (-BlobPath), the unattend XML fragment, and post-join verification
  (systeminfo, nltest, Get-ADComputer).

v1.6.8

Fixed

• Web UI provisioning form returned HTTP 403 (reason=csrf) on every resubmission after any form error (invalid computer name, wrong target prefix, or provisioning failure).

  Two root causes:

  • The error re-render rotated the anti-CSRF session token to a new value.
  • Set-PodeResponseStatus -Code <4xx> rendered Pode's built-in error page and marked the response as sent, so the re-rendered form (carrying the rotated token) was discarded and never reached the browser. The next submit then posted the stale token while the session held the rotated one, failing the CSRF check indefinitely.

  The token is now stable per session (no rotation on re-render), and every Set-PodeResponseStatus that precedes our own HTML now uses -NoErrorPage - so the form with its inline error message is what the browser receives, and corrected resubmissions succeed.

Deploy

Re-extract this release into your runtime folder (e.g. C:\Install\CrossForestOfflineJoin-main), then restart:

.\src\WebService\Start-OfflineJoinService.ps1 -ConfigPath .\src\WebService\appsettings.local.psd1

v1.6.7

Fixed

• Standalone WindowsAd mode showed no login form and returned HTTP 500
  (Cannot bind argument to parameter 'User' because it is an empty string).
  The protected /ui routes were incorrectly flagged with -Login. In Pode a
  -Login route allows anonymous GET so it can render a sign-in page, so /ui
  executed with no authenticated user ($WebEvent.Auth.User empty) and crashed
  before redirecting to the login page. The -Login flag now applies only to
  the dedicated /ui/login routes; the protected routes keep plain
  authentication and redirect unauthenticated visitors to the login form.

Upgrade

Re-extract this release over C:\Install\CrossForestOfflineJoin-main (or your
runtime folder) and restart the service. No configuration changes are required.
Browse to /ui - you should now be redirected to the sign-in form.

v1.6.6

Fixed

• Web UI (and API) returned a generic HTTP 500 (The term 'Get-OdjFormBody' is not recognized).
  Pode route/auth handlers execute in separate runspaces that only auto-import functions defined
  in the entry-point script itself. The audit-logging and HTML-builder helpers live in separately
  dot-sourced files (OfflineJoinLogging.ps1, OfflineJoinWebUi.ps1), so their functions were
  invisible to those runspaces. The helper scripts are now registered via Use-PodeScript, which
  imports their functions into every runspace.
• Added Pode terminal error logging (Enable-PodeErrorLogging) so unhandled route/auth exceptions
  are surfaced on the console instead of only a bare 500.

Changed

• docs/quickstart.md, docs/schnellstart.md: corrected the WindowsAd auth description - the
  standalone mode serves a hosted HTML sign-in form (backed by a server-side session cookie),
  not HTTP Basic.

Upgrade

Re-extract this release over C:\Install\CrossForestOfflineJoin-main (or your runtime folder)
and restart the service. No configuration changes are required.

v1.6.5

Added

• src/WebService/Start-OfflineJoinService.ps1: the Web UI can now run without IIS. A new WebUi.AuthMode setting selects the authentication scheme:
  • 'WindowsAd' (new default) serves a hosted HTML login form and validates the submitted AD credentials directly against Active Directory over the existing TLS channel, restricted to AdminGroup and backed by a server-side session cookie (with login/logout routes). This makes /ui usable when Pode is self-hosted standalone.
  • 'IIS' keeps the previous behaviour, consuming the Windows identity forwarded by IIS's ASP.NET Core Module for seamless Kerberos single sign-on.
• src/WebService/OfflineJoinWebUi.ps1: new Get-OdjLoginBody helper renders the standalone login form.
• src/WebService/appsettings.psd1: documents the new optional WebUi.AuthMode key (defaults to 'WindowsAd').

Fixed

• Standalone Web UI requests previously failed with HTTP 401 "No MS-ASPNETCORE-WINAUTHTOKEN header found" because Add-PodeAuthIIS only works behind IIS. The default WindowsAd mode resolves this without requiring IIS.

Documentation

• docs/quickstart.md and docs/schnellstart.md: the Web UI for AD admins section now documents both WebUi.AuthMode values (standalone WindowsAd default vs. IIS).
• README.md and docs/README.en.md: the Web UI description, the "Web UI hardening" security bullet, and the architecture-diagram /ui label reflect the new AD-group authentication with the WindowsAd/IIS modes instead of IIS-only Windows Authentication.