v2.2.0-beta1

Warning

This is a beta release, not meant for production use. Use it to test brand-new functionalities.

About this release

Configure exactly how users authenticate with multi-step MFA, including FIDO2 security keys. Administrators have full control over MFA flows for each location, with stronger authentication options for high-security environments.

Users can now configure their Multi-Factor Authentication (MFA) factors directly in the desktop application at any time, even after enrolment. Admins can enforce stronger security without disrupting access, while users manage their authentication seamlessly.

The mobile client has also been redesigned, joining the rest of the refreshed Defguard family.

✨ What's new

• Multi-step configurable MFA methods
• Use FIDO2 hardware key as MFA factor - add it as a passkey in your profile, configure an MFA Flow with FIDO2 Security Key factor, assign it to your location and connect using the latest Desktop Client.
• Post-enrolment MFA configuration
• Bulk actions for Firewall module
• Handling multiple locations with DNS configuration connected simultaneously
• Ability to apply custom MTU to the client apps
• Allow configuring WireGuard interface metric on Windows
• Bulk action to put enrolment token in Active Directory for the auto-provisioning process
• Completely redesigned Mobile Client - try it out by joining our beta channels or by installing packages from the release assets (more details in the mobile release).

🧪 How to test

🚀 Quickly run the latest server components using one-line-script in pre-release mode.

🔄 Worried that your users have to upgrade the client applications? Here you can check the client vs server feature compatibility matrix.

🙋 Feedback

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

Full changelog

• register fido2 factor via desktop client by @filipslezaklab in #3689
• Load-testing-related performance improvements by @j-chmielewski in #3697
• Disallow CIDR of /31 and fix address range handling by @moubctez in #3708
• Load generator by @j-chmielewski in #3702
• MFA flow minor fixes by @t-aleksander in #3711
• Add RPC to end an mfa configuration session by @t-aleksander in #3680
• logout all web sessions on password reset via Edge by @wojcik91 in #3757
• Duplicate Firewall rules (Aliases/Destinations/Rules) by @jakub-tldr in #3760
• LDAP enrolment token by @moubctez in #3759
• Change Location "Allowed IPs" from a single line text entry field to a managed table by @jakub-tldr in #3764
• Commit Gateway commands after database transaction by @moubctez in #3767
• fix(LDAP): sync users in "Pending" state by @wojcik91 in #3775
• Authorize configure mfa flow with fido2, oidc by @filipslezaklab in #3765
• Fix duplicated display of ACL rule names, fix autofill input color on safari by @t-aleksander in #3766
• Attemp to automate the release process where possible by @t-aleksander in #3726
• MFA flow assignment in location wizard by @j-chmielewski in #3769
• Warn before removing SMTP config when MFA flows use email codes by @j-chmielewski in #3778
• Forward OIDC provider kind to proxy by @jakub-tldr in #3784
• fix: improve UX when removing SMTP is blocked by @wojcik91 in #3776
• fix gateway trim logic on license expiry by @wojcik91 in #3793
• send mfa capabilties to client by @filipslezaklab in #3792
• MFA flow load testing by @j-chmielewski in #3791
• Block duplicated MFA Flow name by @jakub-tldr in #3795
• Add OpenID kind to InstanceInfo by @jakub-tldr in #3799
• Rate limit for MFA flow endpoints, refactor throttling by @t-aleksander in #3737
• Group MTU by @moubctez in #3789
• Add an information when flows for location are blocked by instance config by @filipslezaklab in #3801
• E2E tests for rate limits by @t-aleksander in #3805
• Group MTU take 2 by @moubctez in #3806
• Store JSON in LDAP by @moubctez in #3809
• Port recent LDAP fixes from stable to dev by @t-aleksander in #3813
• split MFA flows from legacy MFA at contract level by @wojcik91 in #3797
• send openid and smtp configured flag via instance-info by @filipslezaklab in #3804
• Remove secret values from API responses by @jakub-tldr in #3816
• Fix flow cards by @filipslezaklab in #3812
• Fix tests on the dev branch by @t-aleksander in #3819
• Adjust e2e tests to new mfa flows by @t-aleksander in #3821
• port ignore for release from the dev branch by @t-aleksander in #3824
• Add new user active statuses for Okta (#3817) by @t-aleksander in #3830
• fix legacy mobile approve gate for multi-step sessions by @wojcik91 in #3834

Full Changelog: v2.2.0-alpha1...v2.2.0-beta1