Skip to content

CompDesk v0.9.0-beta.4 — Public Beta

Choose a tag to compare

View all tags
@TahaHydra TahaHydra released this 06 Oct 22:34
· 10 commits to main since this release
v0.9.0-beta.4
7b14a5e

CompDesk v0.9.0-beta.4 — Public Beta

This release adds generic OpenID Connect sign-in, certificate support and a guided SSO migration flow. Email settings now show the configuration for the selected delivery provider.

New and improved

  • Generic OpenID Connect single sign-on. Microsoft Entra ID remains the default. Google, Okta, Keycloak, Auth0, authentik and other standard OIDC providers are available from Settings → Single sign-on, with provider-specific guidance, a copyable redirect URI, and login-button controls. See Single sign-on.
  • SSO migration. Users link the new provider while the previous provider keeps working. An administrator must prove access before cutover; the previous provider remains available during the rollback window. Finishing can optionally remove its old account links.
  • Identity-provider certificates. Configure private-CA trust in Settings or setup. Advanced options support private_key_jwt, RSA/EC signing keys, an optional certificate thumbprint and Key ID, and explicit removal of optional material.
  • SMTP certificates. Private-CA trust and client-certificate authentication are supported, including relays that require a certificate instead of a username and password. Certificate verification stays enabled and stored client keys are encrypted.
  • First-run authentication setup. The wizard includes local / SSO / both, the provider dropdown, advanced certificates, redirect URI and a configuration test. SSO-only setup is refused until an administrator has a linked identity.
  • Email Delivery settings. The SMTP tab is now Email Delivery. Selecting Microsoft 365 / Graph hides SMTP configuration and certificate cards; selecting SMTP shows them. Switching providers preserves the other provider's saved configuration.
  • The roadmap now records OIDC and certificate support as implemented rather than planned.

Fixes and security

  • Generic OIDC identities are bound to issuer + subject; email addresses never link accounts automatically. Providers that explicitly report an unverified email are refused.
  • OIDC requests validate the issuer and discovered endpoints and reject insecure HTTP endpoints in production. Loopback HTTP remains available for development tests.
  • Shared authentication guards protect login-method changes, direct provider switches and migration transitions. Saved settings that require a restart are distinguished from the running configuration.
  • Settings cards save only their changed fields and preserve drafts in other cards. Certificates and optional key material have explicit Remove actions.
  • Branding saves no longer enable SSO implicitly, and fresh installations no longer show an unusable Microsoft sign-in button.
  • Development compilation and the managed Docker setup's unused database-password requirement were corrected.
  • sharp is updated to 0.35.5 and source-map-js to 1.2.2 to address the production dependency findings. Intentional weak-key rejection fixtures remain tested, with narrowly scoped static-analysis suppressions.

Upgrade and rollback

Back up PostgreSQL, private attachments, uploaded branding, and the private configuration volume together. Download this release's version-pinned docker-compose.yml, review it against your deployment configuration, then run from the deployment directory:

docker compose pull
docker compose up -d
docker compose logs --tail=100 compdesk

Keep existing data volumes. The additive 20261006120000_login_sso_enabled migration copies beta.3's Microsoft login switch to login_sso_enabled and retains the old row. LOGIN_MICROSOFT_ENABLED remains a fallback when LOGIN_SSO_ENABLED is unset.

Beta.3 can run against the upgraded database in the rehearsed topology. If you change its Microsoft login switch after rolling back, review Settings → Single sign-on when upgrading again: the migration runs only once. For a complete recovery, retain the matching database/configuration/files backup; an older image alone is not a recovery point. See upgrade guidance and backup/restore.

Verification and beta limits

The development acceptance record covers Keycloak 26.4 with client secrets, private_key_jwt, private-CA HTTPS, explicit account linking, duplicate/unverified email refusal, and migration cutover/rollback/finish. SMTP was exercised with a private CA and mutual TLS without a password. A separate beta.3 → beta.4 rehearsal preserved data, configuration and uploads, exercised image rollback and backup restoration, and verified a fresh setup. See the rehearsal record.

The new generic-provider presets have not all been tested against real cloud identity providers. Live Graph mailbox delivery and broader multi-user/browser coverage remain pending. SMTP/Graph acceptance does not confirm delivery to a recipient mailbox. Development dependencies have a separate disclosed audit scope; this release does not claim zero vulnerabilities across all development tooling. This is a public beta.

Publication checks

Verified release source: 7b14a5e8f286c3654db814dcf31479bd1987b2d2.

  • Main CI and main Security passed, including setup E2E, backup/restore, CodeQL, container scanning and Gitleaks.
  • Tagged-image scan and publication passed. The released image digest is sha256:81cc71f95ac320fdc57f3584b00e8cd1dfed42618cad2fb0a8aad8d5b537c9d0.
  • The published image contains sharp 0.35.5 and source-map-js 1.2.2, runs as UID 1001, and excludes the build-only CSS/glob packages. The production dependency audit has zero findings.
  • Anonymous release metadata, Compose downloads and the exact image digest were verified without GitHub credentials.
  • A disposable installation using the actual release Compose asset passed setup, readiness, administrator sign-in, branding upload, and restart persistence for sessions, configuration, uploaded branding and private storage.
Previous releases and rollback downloads
Assets 3
Loading