Skip to content

Release v2.50.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 03:25
v2.50.0
906ed20
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Operators can now require every token from an external issuer to carry a verified tenant. Turn it on when external issuers sign tokens for more than one tenant; the setting is off by default so existing deployments keep working.

Added

  • Authentication:ExternalTokenTenantBinding setting. When enabled, a token from an external issuer is accepted only if it carries exactly one configured tenant claim (optionally mapped to a tenant through issuer-scoped mappings). A token whose tenant differs from the addressed tenant is refused with 403. Headers, routes and tool arguments only select a target and never constrain the credential. Startup validation rejects incomplete settings, and a startup warning appears when external bearer tokens are configured without it. (part of #270)
Assets 2
Loading