chore(deps): update oryd/kratos docker tag to v1 #1477
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.13.0->v1.2.0Release Notes
ory/kratos (oryd/kratos)
v1.2.0Compare Source
Ory Kratos v1.2 is the most complete, scalable, and secure open-source identity server available. We are thrilled to announce its release!
This release introduces two major features: two-step registration and full PassKey with resident key support.
Passkeys provide a secure and convenient authentication method, eliminating the need for passwords while ensuring strong security. With this release, we have added support for resident keys, enabling offline authentication. Credential discovery allows users to link existing passkeys to their Ory account seamlessly.
passkeys.webm
Two-step registration improves the user experience by dividing the registration process into two steps. Users first enter their identity traits, and then choose a credential method for authentication, resulting in a streamlined process. This feature is especially useful when enabling multiple authentication strategies, as it eliminates the need to repeat identity traits for each strategy.
The 107 commits since v1.1 include several improvements:
Two-Step Registration Enabled by Default: This is now the default setting. To disable, set
selfservice.flows.registration.enable_legacy_one_steptotrue.return_toparameter is now respected in OIDC API flows.verificationandverification_uihooks are now available in the login flow.We are doing this survey to find out how we can support self-hosted Ory users better. We strive to provide you with the best product and service possible and your feedback will help us understand what we're doing well and where we can improve to better meet your needs. We truly value your opinion and thank you in advance for taking the time to share your thoughts with us!
Fill out the survey now!
Breaking Changes
This feature enables two-step registration per default. Two-step registration is a significantly improved sign up flow and recommended when using more than one sign up methods. To disable two-step registration, set
selfservice.flows.registration.enable_legacy_one_steptotrue. This value defaults tofalse.Bug Fixes
Add login succeeded event to post registration hook (#3739) (b685fa5)
Add missing env vars to set up guide (#3855) (da90502):
Closes https://github.com/ory/kratos/issues/3828
Add missing indexes and remove unused index (6d7372e)
Add missing indexes and remove unused index (#3756) (c905f02)
Add sms mfa via parameter to spec (#3766) (b291c95)
Allow updating just the verified_at timestamp of addresses (#3880) (696cc1b)
Always issue session last (#3876) (e942507):
In post persist hooks, the session issuance hook always needs
to come last. This fixes the getHooks function to ensure this.
Audit issues (#3797) (7017490)
Change return urls in quickstarts (#3928) (9730e09)
Close res body (#3870) (cc39f8d)
CVEs in dependencies (#3902) (e5d3b0a)
Db index and duplicate credentials error (#3896) (9f34a21):
Do not require method to be passkey in settings schema (#3862) (660f330)
Don't require connection_uri in SMTP (#3861) (800f8f1)
Don't treat passkeys as AAL2 (#3853) (8eee972)
Drop index if exists (#3846) (ad0619d)
Drop trigram index on identifiers (#3827) (8f8fd90)
Enum type of session expandables (#3891) (63d785e)
Enum type of session expandables (#3895) (c435727)
Execute verification & verification_ui properly in login flows (#3847) (5aad1c1)
Ignore decrypt errors in WithDeclassifiedCredentials (#3731) (8f5192f)
Improve SDK discriminators (#3844) (c08b3ad)
Include all creds in duplicate credential err (#3881) (e06c241)
Linkedin issuer override (#3875) (11d221a)
Make sure emails can still be sent with SMS enabled (#3795) (7c68c5a)
Missing indices and foreign keys (#3800) (0b32ce1)
oidc: Grace period for continuity container on oidc callbacks (#3915) (1a9a096)
Passing transient payloads (#3838) (d01b670)
Prevent SMTP URL leak on unparsable URL (#3770) (c5f39f4)
Respect return_to in OIDC API flow error case (#3893) (e8f1bcb):
This fix ensures that we redirect the user to the return_to URL
when an error occurs during the OIDC login for native flows.
Native flows are initialized through the API, and the browser
URL is retrieved from a 422 response after a POST to submit the
login flow. Successful OIDC flows already returned the
codetothe
return_toURL. Now, unsuccessful flows return theflowwiththe current flow ID (which might have changed), so that the caller
can retrieve the full flow and act accordingly.
Bump in distroless is still open
sdk: Expand identity in session extension (#3843) (04f0231), closes #3842
sdk: Improve discriminators for node and Go (#3821) (9ddf7cc)
Show error page on identity mismatch (#3790) (e6db689)
Test assertions on declassifying OIDC tokens (#3773) (7f8a7f1)
Tolerate more "truthy" values when creating new flows (#3841) (49d93c0), closes #3839:
Use strconv.ParseBool to accept multiple "truthy" values for the
refreshandreturn_session_token_exchange_codequery parameters whencreating a new login flow.
For some SDKs (e.g.: Python), these stringification of booleans is not
user-controlled and these endpoints could not be used fully due to the
backend ignoring any value other than
true(all lowercase).Tweaks to UpsertSessions (#3878) (da51dcd)
Use correct post-verification identity state in post-hooks (#3863) (6e63d06)
Webhook transient payload in OIDC login flows (#3857) (2cdfc70):
Code Generation
Documentation
Features
Add
include_credentialquery param to/admin/identitieslist call (#3343) (d94530a)Add headers to web hooks (#3849) (4642de0)
Add session to post login webhook (#3877) (386078e)
Add transient payloads to all flows (#3738) (b8b747b)
Add twitter SSO (#3778) (930fb19)
Add verification hook to login flow (#3829) (43e4ead)
Allow admin to create API code recovery flows (#3939) (25d1ecd)
Control edge cache ttl (#3808) (c9dcce5)
Linkedin v2 provider (#3804) (a6ad983):
feat: add linkedin-v2 provider
docs: document linkedin special-case
PassKeys with Resident Keys and two-step registration (#3748) (3621411)
Send OIDC claim keys to tracing (#3798) (04390be)
Use authenticate endpoint for x (#3833) (3d9ba5d):
Improves the "Log in with X" experience by not asking the user to re-authenticate every time.
Tests
Deflake session test (#3864) (6b275f3)
Resolve failing test for empty tokens (#3775) (7277368)
Resolve flaky e2e tests (#3935) (a14927d):
test: resolve flaky code registration tests
chore: don't fail logout if cookie is not found
chore: remove .only
chore: reduce wait
chore: u
chore: u
chore: u
Unclassified
Changelog
087748cRemove unnecessary COPY command from Dockerfile (#3771)d755fbbautogen(docs): generate and bump docsb96c6a5autogen(docs): regenerate and update changelogf8fbb00autogen(docs): regenerate and update changelogbdf992eautogen(docs): regenerate and update changelogb7fd23bautogen(docs): regenerate and update changelog0f81b76autogen(docs): regenerate and update changelogf696fcfautogen(docs): regenerate and update changelog34399c2autogen(docs): regenerate and update changelogecbd1e3autogen(docs): regenerate and update changelog41310b3autogen(docs): regenerate and update changelogfa5a112autogen(docs): regenerate and update changelog9fa25b5autogen(docs): regenerate and update changelogdfc931fautogen(docs): regenerate and update changelog31f77b8autogen(docs): regenerate and update changelogddbea20autogen(docs): regenerate and update changelog9c69ef2autogen(docs): regenerate and update changelog9710549autogen(docs): regenerate and update changelog264395aautogen(docs): regenerate and update changelogcd92f2aautogen(docs): regenerate and update changeloga1bf427autogen(docs): regenerate and update changelog7f1fd81autogen(openapi): regenerate swagger spec and internal client60537a9autogen(openapi): regenerate swagger spec and internal clientda6b38aautogen(openapi): regenerate swagger spec and internal clientb7e5144autogen(openapi): regenerate swagger spec and internal clientec90929autogen(openapi): regenerate swagger spec and internal clientab8e1b5autogen(openapi): regenerate swagger spec and internal client718cb7cautogen(openapi): regenerate swagger spec and internal client0b6f91eautogen(openapi): regenerate swagger spec and internal clientfa806aaautogen(openapi): regenerate swagger spec and internal client3c06689autogen(openapi): regenerate swagger spec and internal client473e17cautogen(openapi): regenerate swagger spec and internal client8ebdfd2autogen(openapi): regenerate swagger spec and internal client644e669autogen(openapi): regenerate swagger spec and internal clientb132c94autogen(openapi): regenerate swagger spec and internal client1459403autogen(openapi): regenerate swagger spec and internal clientdee5844autogen(openapi): regenerate swagger spec and internal client037bdf8autogen(openapi): regenerate swagger spec and internal clientd9dbaadautogen(openapi): regenerate swagger spec and internal clientb47554bautogen(openapi): regenerate swagger spec and internal clienteb67bedautogen(openapi): regenerate swagger spec and internal client5dcbb77autogen(openapi): regenerate swagger spec and internal clientca7cd23autogen(openapi): regenerate swagger spec and internal client6638c3eautogen: add v1.1.0 to version.schema.json1a70648autogen: pin v1.2.0 release commit2baecaeautogen: pin v1.2.0-pre.0 release commit49e1a39chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 (#3805)0f3d082chore(deps): bump github.com/lestrrat-go/jwx from 1.2.28 to 1.2.29 (#3812)83792efchore: allow smtp jim config (#3932)3ecdf2bchore: fix function name in comment (#3869)fbbac77chore: improve courier logging (#3943)5288bc7chore: make identity schema provider a proper service (#3908)63ce470chore: remove e2e playwright env (#3794)17f9a4fchore: render CLI doc messages into their own *.md file in docs (#3886)de8e59cchore: update repository templates to ory/meta@e838bee050a4dcchore: upgrade nyaruka/phonenumbers to v1.3.6 (#3940)0713e2dchore: upgrade ory/x to v0.0.619 (#3845)cd01cb9docs: remove delete reference from batch patch identity (#3906)3621411feat: PassKeys with Resident Keys and two-step registration (#3748)d94530afeat: addinclude_credentialquery param to/admin/identitieslist call (#3343)4642de0feat: add headers to web hooks (#3849)386078efeat: add session to post login webhook (#3877)b8b747bfeat: add transient payloads to all flows (#3738)930fb19feat: add twitter SSO (#3778)43e4eadfeat: add verification hook to login flow (#3829)25d1ecdfeat: allow admin to create API code recovery flows (#3939)c9dcce5feat: control edge cache ttl (#3808)a6ad983feat: linkedin v2 provider (#3804)04390befeat: send OIDC claim keys to tracing (#3798)3d9ba5dfeat: use authenticate endpoint for x (#3833)1a9a096fix(oidc): grace period for continuity container on oidc callbacks (#3915)04f0231fix(sdk): expand identity in session extension (#3843)9ddf7ccfix(sdk): improve discriminators for node and Go (#3821)e5d3b0afix: CVEs in dependencies (#3902)b685fa5fix: add login succeeded event to post registration hook (#3739)da90502fix: add missing env vars to set up guide (#3855)6d7372efix: add missing indexes and remove unused indexc905f02fix: add missing indexes and remove unused index (#3756)b291c95fix: add sms mfa via parameter to spec (#3766)696cc1bfix: allow updating just the verified_at timestamp of addresses (#3880)e942507fix: always issue session last (#3876)7017490fix: audit issues (#3797)9730e09fix: change return urls in quickstarts (#3928)cc39f8dfix: close res body (#3870)9f34a21fix: db index and duplicate credentials error (#3896)660f330fix: do not require method to be passkey in settings schema (#3862)800f8f1fix: don't require connection_uri in SMTP (#3861)8eee972fix: don't treat passkeys as AAL2 (#3853)ad0619dfix: drop index if exists (#3846)8f8fd90fix: drop trigram index on identifiers (#3827)63d785efix: enum type of session expandables (#3891)c435727fix: enum type of session expandables (#3895)5aad1c1fix: execute verification & verification_ui properly in login flows (#3847)8f5192ffix: ignore decrypt errors in WithDeclassifiedCredentials (#3731)c08b3adfix: improve SDK discriminators (#3844)e06c241fix: include all creds in duplicate credential err (#3881)11d221afix: linkedin issuer override (#3875)7c68c5afix: make sure emails can still be sent with SMS enabled (#3795)0b32ce1fix: missing indices and foreign keys (#3800)d01b670fix: passing transient payloads (#3838)c5f39f4fix: prevent SMTP URL leak on unparsable URL (#3770)e8f1bcbfix: respect return_to in OIDC API flow error case (#3893)e6db689fix: show error page on identity mismatch (#3790)7f8a7f1fix: test assertions on declassifying OIDC tokens (#3773)49d93c0fix: tolerate more "truthy" values when creating new flows (#3841)da51dcdfix: tweaks to UpsertSessions (#3878)6e63d06fix: use correct post-verification identity state in post-hooks (#3863)2cdfc70fix: webhook transient payload in OIDC login flows (#3857)6b275f3test: deflake session test (#3864)7277368test: resolve failing test for empty tokens (#3775)a14927dtest: resolve flaky e2e tests (#3935)Artifacts can be verified with cosign using this public key.
v1.1.0Compare Source
Ory Kratos v1.1 is the most complete, most scalable, and most secure open-source identity server on the planet, and we are thrilled to announce its release! This release comes with over 270 commits and an incredible amount of new features and capabilities!
Don't forget to leave a GitHub star and check out our other open source projects while you're here :)
Note: To ensure a seamless upgrade experience with minimal impact, some of these features are gated behind the
feature_flagsconfig parameter, allowing controlled deployment and testing.return_toparameter set in the API call.The following features have been shipped exclusively to Ory Network for this version:
strong,eventual).Ory Kratos 1.1 is a major release that marks a significant milestone in our journey.
We sincerely hope that you find these new features and improvements in Ory Kratos 1.1 valuable for your projects. To experience the power of the latest release, we encourage you to get the latest version of Ory Kratos here or leverage Ory Kratos in Ory Network — the easiest, simplest, and most cost-effective way to run Ory.
For organizations seeking to upgrade their self-hosted solution, Ory offers enterprise support services to ensure a smooth transition. Our team is ready to assist you throughout the migration process, ensuring uninterrupted access to the latest features and improvements. Additionally, we provide various support plans specifically tailored for self-hosting organizations. These plans offer comprehensive assistance and guidance to optimize your Ory deployments and meet your unique requirements.
We extend our heartfelt gratitude to the vibrant and supportive Ory Community. Without your constant support, feedback, and contributions, reaching this significant milestone would not have been possible. As we continue on this journey, your feedback and suggestions are invaluable to us. Together, we are shaping the future of identity management and authentication in the digital landscape.
Contributors to this release in no particular order: moose115, K3das, sidartha, efesler, BrandonNoad ,Saancreed, jpogorzelski, dreksx, martinloesethjensen, cpoyatos1, misamu, tristankenney, nxy7, anhnmt
Are you passionate about security and want to make a meaningful impact in one of the biggest open-source communities? Join the Ory community and become a part of the new ID stack. Together, we are building the next generation of IAM solutions that empower organizations and individuals to secure their identities effectively.
Want to check out Ory Kratos yourself? Use these commands to get your Ory Kratos project running on the Ory Network:
Breaking Changes
Pagination parameters for the
list identitiesCLI command have changed from arguments to flags--page-tokenandpage-size:Furthermore, the JSON / JSON pretty output of
list identitieshas changed:Closes https://github.com/ory/sdk/issues/284
Closes https://github.com/ory/kratos/pull/3480
Bug Fixes
oidcdoes not require a method in the payload (#3564) (b299abc):fix:
oidcdoes not require a method in the payloadrefactor: only update strategies order in test
chore: update audit messages and comments
Accept all 200 responses as OK in courier (#3401) (88237e2), closes #3399:
Accept login_challenge after verification (#3427) (6b02350):
Part of https://github.com/ory/network/issues/320
Add caching to Jsonnet snippet during session JWT tokenization (#3699) (1da8180)
Add consistency flag (#3733) (fd79950)
Add max-age to default cors headers (#3584) (c5b4aaa)
Add missing tracing & attributes in oidc strategy (#3429) (09bcb71)
Add return_to parameter to API spec of createRecoveryLinkForIdentity (#3711) (757a5e4)
Add value code to authentication method enum (#3546) (95dc7a2):
fix: add value code to authentication method enum
chore: generate sdk
Additional_id_token_audiences key in config schema (#3622) (9396bb0)
Adjust tracing verbosity (976cd0d)
Allow post recovery hooks to interrupt the flow (#3393) (6c1d2f1)
Allow updating admin metadata from webhook responses (#3569) (22f61f0)
Always return relative URLs in the Link header for pagination (fb229c9)
Auto migrate old accounts to use code credential (#3581) (569b14a)
Carry
oauth2_login_challengeover to registration flow (#3419) (76241be):Fixes https://github.com/ory/kratos/issues/3321
Change ListIdentities to keyset pagination (e16fed1)
Change shebangs and makefile from /bin/bash to /usr/bin/env bash (#3597) (1343bbb):
makefile fix
shebangs changed to /usr/bin/env bash
Signed-off-by: nxy7 lolnoxy@gmail.com
Check whoami aal before accepting hydra login request (#3669) (a2f79c3)
Code method on registration and 2fa (#3481) (7aa2e29)
Consider OIDC registration flows errored with duplicate credential to be completed by strategy (#3525) (3e3c789):
Returning anything else here may cause Kratos to respond with two concatenated JSON objects: new login flow with actual error message as the first one and a very confusing '500, aborted registration hook execution' as the second one.
Csrf token regenerate on browser flows (#3706) (e4908db), closes #3705
Data race in test (ab6dc31)
Do not encode full config in multiple places (#3500) (57a3273)
Do not generate CSRF token for api flows (#3704) (d93570d)
Do not initialize parts of the registry in parallel (#3534) (ff177db)
Don't list org SSOs in settings (#3637) (6c7068c)
Don't require code credential for MFA flows (#3753) (40ed809)
Don't require session for OIDC verification (#3443) (e08f831)
Don't return 500 on conflict for POST /admin/identities (#3437) (1429949)
Don't return nil if code is invalid (#3662) (df8ec2b):
fix: don't return nil if code is invalid
chore: add test
Error handling on identity import (#3520) (83bfb2d):
When importing identities without any traits, or with malformed traits, 500s are returned. This improves the error handling and messaging.
False-positives for requiring re-authentication on update (#3421) (ce8139f)
Http courier using should use lower case json (#3740) (84149c4)
Identity list pagination in CLI command and SDK (#3482) (1e8b1ae):
Adds correct pagination parameters to the SDK methods for listing identities and sessions.
Ignore CSRF middleware on Apple OIDC callback (309c506)
Ignore more cloudflare cookies (#3499) (f124ab5)
Improved SSRF protection (#3629) (6d08576):
This also improves tracing in the OIDC strategy.
Incorrect login accept challenge (#3658) (b5dede3)
Incorrect sdk generator path (#3488) (ed996c0)
Incorrect SMTP error handling (#3636) (ee138ec)
Incorrect swagger spec for filter parameter (#3684) (2c1470a), closes #3676 #3675
Increase connection-level timeouts and shutdown timeouts (#3570) (200b413):
The admin API is generally expected to require longer timeouts, for example during bulk identity import.
Issue session after verification after registration with OIDC SSO (#3467) (a28b523)
Lint (e8740c3)
Lower-case recovery & verification emails on import (#3571) (e2ac9ff):
Emails that contained upper-case characters would be overwritten by the identity schema extension runner, because there all emails are lower-cased.
Mark identity as optional in session struct (#3463) (7ae02ba), closes #3461:
The identity is not always available in the session struct, for example when AAL2 is required.
Omit irrelevant OIDC providers in forced refresh login flows (#3608) (912dccd):
Whenever an user is asked to reauthenticate (e.g. because they wish to execute settings flow touching their credentials and their session is no longer privileged) they are asked to provide their credentials again. The forced-refresh login flow generated for such cases already excludes some strategies that are enabled in Kratos but cannot be used to authenticate as current identity, and for example the form presented to the user will not have a password field if the identity does not have a password credential.
This, however, does not currently apply to OIDC providers; the user will always see the full set even if some of them can't be used to sign in as current identity. This change causes forced refresh login flows to also omit irrelevant OIDC providers in generated form in order to avoid confunding the user about which strategies/providers are valid and can actually be used to reauthenticate.
On verification required after registration, preserve return_to (#3589) (6a0a914):
fix: on verification required after registration, preserve return_to
test: return_to on verification flow
chore: refactor
Panic in recovery (#3639) (c25ddff)
Pass context (#3452) (c492bdc)
Properly normalize OIDC verified emails (#3450) (703b910)
Redirect to verification URL even if login_challenge is set (#3412) (cd9e6a0):
Fixes https://github.com/ory/network/issues/320
Reduce db lookups in whoami for aal check (#3372) (d814a48):
Significantly improves performance by reducing the amount of queries we need to do when checking for the different AAL levels.
Registration code ui nodes group (#3505) (6220184):
fix: registration code ui nodes group
style: format
Registration should accept hydra login (#3592) (7a47827):
fix: registration should accept hydra login
fix: oauth2 registration flow with session
wip: registration oauth flow tests
wip: refactor oauth flows test
wip: refactor op_registration_test
wip: oauth provider registration test
wip: refactor oauth flows test
fix(test): oauth provider login
s
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.