Taranac 1.1.2

Added

• Matched policy rule in TACACS+ log detail. The authentication and
  authorization log detail views now show the UUID of the policy rule that
  matched, alongside its name — a stable identifier for correlation.

Changed

• Precise LDAP sign-in failure reasons. A failed LDAP/Active Directory login
  now reports the specific cause — wrong password, account locked, disabled,
  expired, or "must change password" — instead of a generic "invalid credentials".

Fixed

• Non-shell vendor authorization profiles now deploy correctly. TACACS+
  profiles built on a non-shell template (Juniper junos-exec, FortiGate, Palo
  Alto, …) were reduced to a generic shell / privilege-15 block in the deployed
  daemon config and the Policy Tester preview, even though the per-profile config
  preview was correct. The daemon config now renders every vendor service and raw
  attribute, matching the preview.
• Correct privilege level for a just-created user's first login. A user created
  moments earlier could authenticate but be granted a default privilege level on
  that first session, because the (separately handled) authorization step didn't
  yet know the new user. Authorization now loads the user the same way login does,
  so the privilege level from the matched policy rule applies immediately.
• TOTP replay protection now holds across the whole server. A one-time MFA code
  can no longer be reused within its short validity window by directing the retry
  at a different worker process or cluster node; used codes are now tracked in a
  shared store rather than per process.
• New-IP login alert email shows the browser. The "sign-in from a new IP"
  notification always rendered an empty Browser row; it now reports the client's
  browser (or "Unknown" for header-less API callers).