v1.4.3

Security

• SAML documents are now parsed with entity resolution, DTD loading, and
  network access all switched off, and any document carrying a <!DOCTYPE>
  is refused outright. A SAML response arrives at the assertion consumer
  endpoint before anyone has proved who they are, and its status is read
  before its signature is checked, so that parse was reachable by anybody who
  could reach the endpoint. A crafted document could have been used to read
  files off the IdPVault host or to make it fetch a URL of the sender's
  choosing. No standards-compliant identity provider sends a DOCTYPE, so this
  changes nothing about normal sign-in.
• Fetching identity provider metadata by URL is now restricted to http and
  https, follows at most three redirects, and refuses a document larger than
  2 MB. Local addresses are unaffected - metadata hosted on your own network,
  including a self-hosted authentik, works exactly as before.
• The authorization endpoint advertised in an OpenID Connect discovery
  document must now live on the same host as the issuer and cannot downgrade
  an https issuer to http. A tampered or hostile discovery document can no
  longer bounce a sign-in attempt to an unrelated site.

v1.4.2

Changed

• With single sign-on configured, a user created by hand is now external
  automatically - the checkbox is ticked and locked, with the reason shown.
  Once SSO is on, staff accounts arrive from your identity provider at first
  sign-in or over SCIM, so anyone still being typed into the create form is by
  definition someone outside your directory: a contractor or a client contact.
  Role and password are unchanged - external users sign in with a password, so
  they still need both. Enforced server-side, not just in the form.

v1.4.1

Fixed

• Browse on a backup now opens directly beneath that backup's row instead of
  at the bottom of the page. On a tenant with restore history and search
  results below the snapshot list, the panel could open entirely off-screen
  and clicking Browse looked like it had done nothing. Clicking Browse again
  on the same row closes it.
• Clicking an object in Browse, Compare or Changes now opens its JSON in a row
  directly beneath that object, and the header shows the object's name
  rather than only its id. Previously the JSON appeared in a panel at the foot
  of the table, so you had to scroll away from the row you clicked to read it,
  and the heading gave you a bare uuid. Clicking the same object again closes
  it.
• Compare now opens immediately below the Snapshots list rather than below
  every other panel on the page.
• The Live State view now honours the Live view refresh interval setting.
  It was caching the live provider config for a fixed two minutes regardless
  of what you had configured, so leaving a tenant Overview and coming back
  re-queried the provider from scratch. Set the interval to 30 minutes and the
  provider is now queried at most every 30 minutes, however many times you
  navigate away and back. Refresh Config from provider still fetches
  immediately.
• Opening a tenant Overview cost two full provider exports - one for the
  drift summary and another for the Live State category list. The summary's
  export is now reused, halving the provider calls on every Overview load.

v1.4.0

Added

• Sign in with your identity provider. IdPVault now supports OpenID Connect
  single sign-on (authorization code with PKCE), configured in Administration >
  System settings > Single sign-on. Point it at your provider's issuer URL and
  it reads the rest from the discovery document; a Test connection button
  checks the provider before you turn anything on. Available on Business and
  MSP licenses.
• SCIM 2.0 provisioning. Your identity provider can create, update and
  deactivate IdPVault accounts automatically. Deactivating someone in your
  directory disables their IdPVault account - it is never deleted, so the
  audit trail survives.
• Push Groups. Groups your provider pushes over SCIM appear in their own
  section, and each can be mapped to a role. A person gets the highest role
  they are mapped to across their groups, re-evaluated whenever their
  membership changes. Leaving every mapped group returns them to the default
  role for SSO users.
• People can now sign in with their email address. Names (first and last) were
  added to accounts and are shown as "First Last (email)" throughout.
• SAML 2.0 single sign-on, alongside OpenID Connect. Pick the protocol in
  System settings and the fields change to match. Paste your provider's
  metadata URL and IdPVault reads the entity ID, sign-in endpoint and signing
  certificate from it; save again after a certificate rotation to pick up the
  new one. Your metadata URL is shown for import at the provider.
• SSO mode Required turns password sign-in off, and break-glass accounts.
  Flag an administrator as break-glass and that account keeps password
  sign-in when SSO is required - the way back in if your identity provider is
  down. Break-glass sign-ins are called out separately in the audit log.
• Client users can be flagged external. External people are not in your
  directory, so they keep password sign-in when SSO is required. Org-scoped
  roles are external automatically.
• System settings sections are collapsible, each with a status chip showing
  what is configured without opening it.
• App users can now be edited. Edit on any row opens first and last name,
  email, role, client org, and the external and break-glass flags. The table
  gained a Name column showing "First Last (email)" and an MFA column, and
  Reset MFA only appears on accounts that actually have it on.
• Your own row is editable - on a single-admin install that is the only way to
  flag the first break-glass account. Changing your own role or client org, or
  disabling yourself, still needs another administrator.

Changed

• Accounts created before this release keep signing in with their username
  exactly as before. Nothing needs to be changed on an existing install.
• Your identity provider owns the names of anyone who signs in through it -
  they refresh at every sign-in.

Security

• New accounts created by a provider are never placed inside an MSP client
  organization, and group role mapping only ever grants the global
  administrator or user roles. Client organization roles stay assigned inside
  IdPVault.
• Role mapping will not demote the last active administrator and never changes
  a break-glass account, and provisioning will not deactivate the last active
  administrator. Every skipped change is recorded in the audit log with its
  reason.
• SSO cannot be set to Required until at least one active administrator is
  flagged break-glass and has MFA enabled. Once required, that pairing cannot
  be taken away: disabling, deleting, demoting, clearing break-glass on, or
  resetting MFA for the last such account is refused, and your directory
  cannot deactivate it over SCIM either.
• The last active administrator can no longer be disabled, deleted or demoted
  by any route.
• Accounts created by your identity provider cannot sign in with a password at
  all, in any mode.
• Deleting a user is now two deliberate steps: disable first, then delete. The
  Delete button only appears on an account that is already disabled.
• Email addresses are unique across accounts, compared case-insensitively.
• Deleting a user now also removes their trusted-device records, which
  previously could refuse the delete outright.

v1.3.5

• A snapshot whose provider refused one or more resource types now says so in
  the app. The snapshot list shows an amber partial badge beside ok, and
  hovering it lists each type with the provider's own reason. The tenant
  Overview carries the same warning while the condition lasts, and finishing a
  manual backup that hit one reports it instead of a clean "complete".
• A partial backup can no longer be mistaken for a complete one.

v1.3.4

• A resource type your identity provider will not let IdPVault read no longer
  fails the whole backup. Previously a single unreadable endpoint meant the
  backup produced nothing at all; now every other resource type is captured
  normally and the one that was refused is recorded on the snapshot with the
  reason from your provider. This affects, for example, Okta orgs without API
  Access Management, which return an error for authorization servers.
• Refused resource types are recorded on the snapshot manifest, never inside
  the snapshot itself, so they cannot appear as drift, raise an alert, or be
  treated as something to restore.
• Errors from a provider now include that provider's own error code rather
  than only an HTTP status.

v1.3.3

Changed

• In Live State and snapshot Browse, the Terraform button is now disabled
  (with a hover tooltip explaining why) for objects the official provider
  cannot manage - Auth0's global client, Okta system apps, built-in groups,
  and the like - instead of showing an active button that errored on click.
  The object is still backed up; only its Terraform export is unavailable.

v1.3.2

Added

• Auth0 backups now capture Application Grants (client grants - the M2M
  application-to-API authorizations), and Terraform export emits them as
  auth0_client_grant with import blocks. Grants are backup/export only for
  now (not restored). Synced from the shared Terraform engine.

Changed

• Auth0 rail labels follow the Auth0 dashboard: "Applications (clients)",
  with Application grants grouped under Applications.
• Auth0's auto-created global client ("All Applications" - the tenant-wide
  classic login page config, not a real application) is skipped in Terraform
  export with an honest reason, like Okta's system apps. It is still backed
  up.

v1.3.1

Security

• Entitlements are now product-stamped: one KelTech signing key serves every
  KelTech app, so each app rejects entitlements issued for a different
  product. Prevents a license for one product from unlocking another via the
  offline-file path. Legacy full keys are unaffected.

Changed

• License page: the air-gapped note now links the offline license file
  generator (idpvault.com/offline-license) next to the upload control.

Fixed

• Deleting a tenant failed with a 500 for any tenant that had ever run a
  backup (foreign-key violation on its snapshot history). Delete now removes
  the tenant's history rows (state, snapshots, runs, events, jobs) and its
  on-disk data in the same operation - the files would be undecryptable
  without the tenant's data key anyway.

v1.3.0

Added

• Activation licensing: license keys purchased at idpvault.com are now short
  activation keys (IDPV-XXXX-XXXX-XXXX-XXXX). Pasting one exchanges it with the
  KelTech license server (license.keltech.ai) for a signed entitlement bound to
  this install, verified offline with the same embedded public key as always.
  The only data ever sent is the license key and a random install id - never
  tenants, configuration, or usage. One license runs on one install at a time
  and can be deactivated and moved freely.
• Deactivate license button: releases the activation on the license server so
  the key is immediately usable on another install.
• Daily license check-in plus a boot-time refresh: renewals and tenant add-ons
  apply automatically, no new key to install. Check-in failures never interrupt
  a valid entitlement.
• Offline license files for air-gapped installs: the customer portal issues an
  instance-bound entitlement file for your install id (now shown on the License
  page). Upload it on the License page - verified entirely offline, the app
  never contacts any server.
• Install id on the License page (random, contains no information about you or
  your tenants).

Changed

• License page: one input accepts an activation key, an offline license file,
  or a classic full key; status now shows how the install is licensed and the
  last license server check-in result.
• Docs (Licensing & tiers), README, and SECURITY.md updated for activation
  licensing and the exact data sent.

Compatibility

• Existing full license keys keep working unchanged (verified offline, no
  network calls). The free Community tier still makes zero network connections.
• The 3-day grace window and non-destructive downgrade are unchanged.