Skip to content

2.4.0-rc.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@lakhansamani lakhansamani released this 20 Jul 11:59
2.4.0-rc.3
b26401d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

SAML 2.0 Identity Provider role (#691) — Authorizer can now act as a SAML IdP, issuing signed assertions to downstream SaaS Service Providers (Zendesk, Notion, Tableau, …), the inverse of the existing SP role.

  • Per-org IdP metadata, SP-initiated and IdP-initiated SSO, RSA-SHA256 signed assertions with configurable NameID + attribute mapping.
  • X.509 signing keys with overlap-window rotation (current → active → retired); metadata publishes all active certs so SPs keep validating across a rotation.
  • New SAMLServiceProvider + SAMLIDPKey storage entities across all 6 DB providers; private keys AES-256-GCM encrypted at rest.
  • Admin surface on GraphQL and gRPC/proto (registered-SP CRUD, cert rotation, retire, SP-metadata XML import) + dashboard UI.
  • Security: strict ACS/entity-ID binding, audience isolation, org-membership + verified-email gating on issuance (no cross-tenant identity), no-XXE metadata import, IDOR-safe admin auth. Two independent security-engineer audits; unit + end-to-end tests through the real handlers.

This is a release candidate (pre-release). Run make test-all-db cross-DB validation before promoting to a stable release.

Assets 2
Loading