Skip to content

Artifact Keeper 1.6.2

Choose a tag to compare

View all tags
@brandonrc brandonrc released this 23 Jul 03:00
v1.6.2
86d9dd7

Artifact Keeper 1.6.2 is a patch release for the 1.6.0 line: three customer-reported migration/OIDC fixes plus a security hardening of federated admin-group mapping. In-place upgrade from 1.6.1 is a drop-in image swap — no database migration.

Highlights

  • OIDC group sync now works out of the box for GitLab, including inherited subgroups (#2831).
  • Nexus/Artifactory migration fixes — virtual repositories no longer copy member data, and proxy/remote repositories migrate correctly (#2821, #2822).
  • Security hardening — federated admin now requires an explicitly configured admin group; a default-open admin-mapping footgun is closed (#2829). Breaking for some SSO setups — see below.

Security — am I affected? (#2829)

If you use OIDC/SAML/LDAP SSO and have not configured an explicit admin group, Artifact Keeper previously granted administrator to any user whose asserted group name merely contained admin / administrators / superusers / artifact-admins — even a benign group like nonadmin-users. 1.6.2 removes that fuzzy fallback: admin is granted only via an explicitly configured, exact-matched admin group.

  • Affected: federated-SSO deployments with no admin group configured that relied on the implicit pattern match.
  • Action: set an explicit admin group per provider — OIDC attribute_mapping.admin_group / OIDC_ADMIN_GROUP, SAML admin_group, LDAP admin_group_dn — matching the exact group your identity provider asserts.

Fixed

  • OIDC group synchronization reads groups_direct (GitLab) and merges the full effective set including inherited subgroups via the OIDC UserInfo endpoint; an explicit groups_claim still takes precedence (#2831).
  • Virtual (Nexus group) repositories are provisioned and member-correlated without transferring member bytes during migration (#2821).
  • Proxy/remote repository migrations capture the upstream URL (Nexus proxy.remoteUrl, Artifactory remote url) instead of failing the upstream-URL constraint (#2822).

Upgrade

Drop-in image swap from 1.6.1; no database migration. Review the breaking note above if you use federated SSO admin mapping.

Container image: ghcr.io/artifact-keeper/artifact-keeper-backend:1.6.2

Full changelog: v1.6.1...v1.6.2

Assets 8
Loading