v2.2.0-beta2

Warning

This is a beta release, not meant for production use. Use it to test brand-new functionalities.

About this release

Configure exactly how users authenticate with multi-step MFA, including FIDO2 security keys. Administrators have full control over MFA flows for each location, with stronger authentication options for high-security environments.

Users can now configure their Multi-Factor Authentication (MFA) factors directly in the desktop application at any time, even after enrolment. Admins can enforce stronger security without disrupting access, while users manage their authentication seamlessly.

The mobile client has also been redesigned, joining the rest of the refreshed Defguard family.

✨ What's new

• Multi-step configurable MFA methods
• Use FIDO2 hardware key as MFA factor - add it as a passkey in your profile, configure an MFA Flow with FIDO2 Security Key factor, assign it to your location and connect using the latest Desktop Client.
• Post-enrolment MFA configuration
• Bulk actions for Firewall module
• Handling multiple locations with DNS configuration connected simultaneously
• Ability to apply custom MTU to the client apps
• Allow configuring WireGuard interface metric on Windows
• Bulk action to put enrolment token in Active Directory for the auto-provisioning process
• Completely redesigned Mobile Client - try it out by joining our beta channels or by installing packages from the release assets (more details in the mobile release).

🧪 How to test

• MacOS - join the public testers in TestFlight using this link or use the package from the release assets.
• Other OSes - use the appropriate package from the release assets.
• Quickly run the latest server components using one-line-script in pre-release mode.

🔄 Worried that your users have to upgrade the client applications? Here you can check the client vs server feature compatibility matrix.

🙋 Feedback

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• post enrollment configure factors by @filipslezaklab in #1169
• Multistep MFA support for CLI by @t-aleksander in #1156
• trigger factor config flow from locations list by @filipslezaklab in #1176
• Unstuck macos by @moubctez in #1178
• Handle log rotation in log watcher by @moubctez in #1180
• Fix CTRL-C handling by @moubctez in #1183
• pick verification method by @filipslezaklab in #1186
• build macos dmg for dev branch by @filipslezaklab in #1190
• Add possible options to CLI help, change wording of MFA flow texts by @t-aleksander in #1189
• persist parts of ui shared session information. by @filipslezaklab in #1194
• fix dmg signing by @filipslezaklab in #1193
• missing ui elements for mfa configurator by @filipslezaklab in #1196
• Auto focus code by @filipslezaklab in #1198
• fix e2e mfa tests by @filipslezaklab in #1199
• Show provider name on when authenticating via OIDC by @jakub-tldr in #1204
• Verify factor setup flow with fido2 and oidc by @filipslezaklab in #1205
• impl explicit session end for mfa config by @filipslezaklab in #1206
• handle mfa capabilities list from instance info by @filipslezaklab in #1208
• handle multiple fido2 devices by @filipslezaklab in #1209
• Don't silently override totp secret during reenrollment by @j-chmielewski in #1210
• OpenID icons based on polling by @jakub-tldr in #1212
• Fix Windows signing by @moubctez in #1218
• Workaround HidApi::new panics by @moubctez in #1219
• fix session state missing fido2 by @filipslezaklab in #1224
• log compatibility decisions on add page by @filipslezaklab in #1225
• split legacy and multi-step MFA flows by @wojcik91 in #1211
• Autostart and start minimized settings by @j-chmielewski in #1222
• Detect conflicting locations on connect by @t-aleksander in #1223
• update location factor guards based on new proto by @filipslezaklab in #1214
• Autostart for Macs by @moubctez in #1233
• loading state for connection button by @filipslezaklab in #1243
• Fix allow prerelease by @j-chmielewski in #1236
• update instance selection step by @filipslezaklab in #1246
• styles update 2 by @filipslezaklab in #1249
• Properly surface listening port and keepalive on MacOS by @t-aleksander in #1250
• Bump wireguard-rs to 0.12.3 by @t-aleksander in #1248
• fix tray init after first instance added by @filipslezaklab in #1252
• Conflicting location detection fixes by @t-aleksander in #1253
• Allow only hardware keys in fido2 mfa flows by @filipslezaklab in #1255
• Adjust verify with oidc button by @jakub-tldr in #1257
• fix auto provisioning support by @wojcik91 in #1245
• dont recommend fido2 key name during registration by @filipslezaklab in #1260
• fix lack of window focus on deep link open by @filipslezaklab in #1261
• Update mfa config design by @filipslezaklab in #1262
• Fido2 UI tweaks by @filipslezaklab in #1264
• Change labels in MFA wizard by @jakub-tldr in #1268
• Move fido code on dev by @t-aleksander in #1263
• Input autofocus by @t-aleksander in #1280
• Change input on verify with security key by @jakub-tldr in #1283
• fix already registered key error message by @filipslezaklab in #1279
• Display clear message when mobile is outdated during remote approve by @j-chmielewski in #1287
• ui fixes by @filipslezaklab in #1289
• Error text fix by @filipslezaklab in #1290
• Pin dependencies (dev) by @renovate[bot] in #1281
• Fix connected location card missing MFA tile in certain scenarios by @filipslezaklab in #1291
• Adjust E2E tests by @jakub-tldr in #1296
• use proper error component by @j-chmielewski in #1294
• Linux service cleanup by @j-chmielewski in #1288
• client ui adjustments by @filipslezaklab in #1297

Full Changelog: v2.2.0-alpha1...v2.2.0-beta2