1.5.5-rc5

wip

v1.5.5-rc4

fix overwriting of external claims

v1.5.5-rc3

extract external registration name from email

v1.5.5-rc2

fix acr_value

v1.5.5-rc1

add external-idp options

v1.5.4

Adds Azure Application Insights telemetry when configuration Insights__ConnectionString is set.

v1.5.3

Anonymizes default (new) resource names by removing the actor's name from them.

v1.5.2

Set minor state cookies as secure in production.
Fix issue with expired account checking.

v1.5.1

Adds an Account__Authentication__ExpireAfterDays = 0 setting that, if set greater than zero, disallows authentication for users whose last login is beyond that interval.

This setting implies a support mechanism since an administrator will need to re-enable the account if necessary.

v1.5.0

Updates handling of client certificates.

The application assumes an upstream ssl terminator validates any client certificate and adds headers with client cert data. While the app can receive the client certificate as a header value, this has drawbacks because 1) passing multiline header values isn't standard, and 2) that work has generally already been done by the upstream terminator.

For security reasons, the operator MUST ensure that configured ssl client cert headers are ONLY set by the upstream ssl terminator.

Changes:

• parses x500 distinguished names in addition to the existing ldapv3 formatted DNs.
• removed the default (nginx) header names. Operators must configure with expected header names.
• allows multiple client cert header options (changed from string to array of string)

## Header values for certificate data received from reverse proxy (i.e. nginx)
## ** These are NOT defaults. You must include your values.  Nginx values are shown.
# Account__Authentication__ClientCertHeader = X-ARR-ClientCert
# Account__Authentication__ClientCertSubjectHeaders__0 = ssl-client-subject-dn
# Account__Authentication__ClientCertIssuerHeaders__0 = ssl-client-issuer-dn
# Account__Authentication__ClientCertSerialHeaders__0 = ssl-client-serial
# Account__Authentication__ClientCertVerifyHeaders__0 = ssl-client-verify

"Security" enhancement

• removed anonymous access from the public /api/version and /api/stats endpoints.