Skip to content

Release v2.10.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 20:50
v2.10.0
3d49481
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds a service-to-service back-channel that notifies the application every time a user actually signs in — when a signed-out user completes an interactive identity-provider login and a fresh session is established. This is the AuthProxy half of Cratis/Studio#877; the application (Studio) records a sign-in event so users can later be notified of new sign-ins.

Added

  • Sign-in notification back-channel: on a genuine logged-out → signed-in transition, AuthProxy POSTs { subject, identityProvider, ipAddress, location, browser, operatingSystem, userAgent } to a configured application endpoint (Cratis/Studio#877).
  • New configuration key Cratis:AuthProxy:SignIn:NotifyUrl, alongside the existing Invite:ExchangeUrl and Link:ExchangeUrl. Leave it unset to disable notifications (Cratis/Studio#877).
  • Approximate location derived from the client IP (honoring X-Forwarded-For) and any geo headers a fronting CDN/proxy adds (CF-IPCountry, X-Geo-*, X-AppEngine-*) — no heavy geo-IP dependency; when no geo headers are present only the IP travels (Cratis/Studio#877).
  • Lightweight built-in User-Agent parsing into browser and operating system, with the raw header also forwarded (Cratis/Studio#877).
  • Documentation: Documentation/configuration/sign-in.md, wired into the configuration TOC (Cratis/Studio#877).

Behavior notes

  • The notification fires only from the provider callback (OnTicketReceived), so it is scoped to real sign-ins — never on reused sessions or ordinary proxied requests. The credential-link flow short-circuits before this point, so a link is never reported as a sign-in.
  • Recording a sign-in is best-effort: any failure is logged and swallowed, and never breaks the sign-in itself.

Security

  • The endpoint is a service-to-service back-channel that carries no bearer token (there is no user-supplied token in this flow); it relies on being network-isolated from browser traffic, exactly like the invite and link exchanges. It trusts the subject AuthProxy delivers from a real provider authentication, never a client-supplied subject.
  • The client IP and derived location are personal data; the application is responsible for handling and retention.

Deployment wiring (set Cratis:AuthProxy:SignIn:NotifyUrl to the Studio Core internal endpoint) is a follow-up and is not part of this PR.

Assets 2
Loading