v2.0.0

Upgrade Guide

https://github.com/jkroepke/openvpn-auth-oauth2/wiki/Upgrade%20V2

What's Changed

💥 Breaking Changes

• feat!: Replace oauth2.openvpn-username-claim and oauth2.openvpn-username-cel with oauth2.openvpn-username by @jkroepke in #942
• feat!: Migrate legacy token validators (oauth2.validate.*) to CEL by @jkroepke in #943
• feat!: Remove --oauth2.validate.issuer by @jkroepke in #944
• feat!: Rename oauth2.validate.cel to oauth2.validate.expression by @jkroepke in #945
• feat!: Refactor client-config by @jkroepke in #949
• fix: restrict OIDC HTTP redirects by @jkroepke in #960
• fix: trust proxy headers only from configured proxies by @jkroepke in #964
• fix: escape profile selector templates by @jkroepke in #966
• fix: bind pprof default to loopback by @jkroepke in #968
• feat: require plugin management password by @jkroepke in #961
• feat!: normalize CEL identity context by @jkroepke in #1012
• feat!: replace the generic CONFIG_ environment prefix with OPENVPN_AUTH_OAUTH2_ by @jkroepke in #1014
• feat!: enforce strict configuration and expose OpenVPN command timeout by @jkroepke in #1016
• fix!: require octal notation for pass-through socket mode by @jkroepke in #1020
• feat!: validate CEL context fields at startup by @jkroepke in #1025
• feat!: remove openvpn.common-name.mode by @jkroepke in #1027
• feat!: remove http.short-url by @jkroepke in #1028
• fix!: use the packaged client-config directory by default by @jkroepke in #1095
• feat!: normalize OAuth2 authentication style values by @jkroepke in #1099

✨ Exciting New Features

• feat: Mark OpenVPN Plugin as stable by @jkroepke in #946
• feat: Drop existing sessions with same username by @jkroepke in #995
• feat: Increase CEL library versions by @jkroepke in #1022

🐞 Bug Fixes

• fix(plugin): reject CR/LF in env values before building management messages by @jkroepke in #936
• fix(plugin): publish management connections only after password auth succeeds by @jkroepke in #935
• fix(plugin): write denied-auth reasons to auth_failed_reason_file by @jkroepke in #937
• fix(plugin): set plugin memory limit during plugin open by @jkroepke in #934
• fix: redact plugin debug environment logs by @jkroepke in #967
• fix: harden management line parsing by @jkroepke in #969
• fix: secure management pass-through access by @jkroepke in #963
• fix: resolve all matching Google groups by @jkroepke in #974
• fix: Avoid disconnect token lookup when refresh is disabled by @jkroepke in #979
• fix: Propagate OpenVPN management command errors by @jkroepke in #1006
• fix: Preserve concurrently refreshed tokens during expiry cleanup by @jkroepke in #1009
• fix: correct v2 release configuration by @jkroepke in #1013
• fix: publish client config before auth success by @jkroepke in #1015
• fix: route Zitadel OIDC logs through the configured logger by @jkroepke in #1024
• fix: prevent OpenVPN plugin authentication races by @jkroepke in #1026
• fix: validate CEL result type at startup by @jkroepke in #1073
• fix: halt replaced unique-user sessions by @jkroepke in #1104

🛠️ Dependencies

• chore(deps): update googleapis to b703f56 by @renovate[bot] in #932
• chore(deps): update googleapis to 925bb5d by @renovate[bot] in #951
• fix(deps): update module github.com/google/cel-go to v0.29.0 by @renovate[bot] in #957
• fix(deps): update module github.com/google/cel-go to v0.29.1 by @renovate[bot] in #958
• chore(deps): update googleapis to f0a9213 by @renovate[bot] in #980
• chore(deps): update go module directive to v1.26.5 by @renovate[bot] in #981
• chore(deps): update module github.com/go-chi/chi/v5 to v5.3.1 by @renovate[bot] in #982
• fix(deps): update module github.com/google/cel-go to v0.29.2 by @renovate[bot] in #983
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.6 by @renovate[bot] in #984
• fix(deps): update golang.org/x by @renovate[bot] in #987
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.7 by @renovate[bot] in #988
• chore(deps): update googleapis to e75dac1 by @renovate[bot] in #989
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.9 by @renovate[bot] in #990
• chore(deps): update golang.org/x/exp digest to 764159d by @renovate[bot] in #997
• chore(deps): update googleapis to 3fe39f3 by @renovate[bot] in #998
• chore(deps): update module github.com/go-logr/logr to v1.4.4 by @renovate[bot] in #1000
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.48.0 by @renovate[bot] in #1005
• chore(deps): update googleapis to b2f2020 by @renovate[bot] in #1007
• fix(deps): update module github.com/google/cel-go to v0.30.0 by @renovate[bot] in #1021
• fix(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by @renovate[bot] in #1031
• chore(deps): update googleapis to 8efbd57 by @renovate[bot] in #1040
• chore(deps): update golang.org/x/exp digest to b88d891 by @renovate[bot] in #1039
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.48.1 by @renovate[bot] in #1045
• chore(deps): update googleapis to 6ac0973 by @renovate[bot] in #1076
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.49.2 by @renovate[bot] in #1084
• chore(deps): update googleapis to c8921c7 by @renovate[bot] in #1086
• chore(deps): update googleapis to ec0a776 by @renovate[bot] in #1087
• chore(deps): update go module directive to v1.26.6 by @renovate[bot] in #1088
• chore(deps): update module google.golang.org/protobuf to v1.36.12 by @renovate[bot] in #1090
• chore(deps): update module cel.dev/expr to v0.25.3 by @renovate[bot] in #1089
• fix(deps): update golang.org/x by @renovate[bot] in #1094
• fix(deps): update module github.com/google/cel-go to v0.31.0 by @renovate[bot] in #1096

📖 Documentation

• docs: add v2 upgrade notes by @jkroepke in #970
• docs: update the packaged v2 configuration example by @jkroepke in #1011
• docs: document the CEL validation migration for v2 by @jkroepke in #1023
• docs: add Okta provider configuration by @pikkemans in https://gi...

v2.0.0-beta.7

What's Changed

💥 Breaking Changes

• fix!: use the packaged client-config directory by default by @jkroepke in #1095
• feat!: normalize OAuth2 authentication style values by @jkroepke in #1099

🛠️ Dependencies

• fix(deps): update module github.com/zitadel/oidc/v3 to v3.49.2 by @renovate[bot] in #1084
• chore(deps): update googleapis to c8921c7 by @renovate[bot] in #1086
• chore(deps): update googleapis to ec0a776 by @renovate[bot] in #1087
• chore(deps): update go module directive to v1.26.6 by @renovate[bot] in #1088
• chore(deps): update module google.golang.org/protobuf to v1.36.12 by @renovate[bot] in #1090
• chore(deps): update module cel.dev/expr to v0.25.3 by @renovate[bot] in #1089
• fix(deps): update golang.org/x by @renovate[bot] in #1094
• fix(deps): update module github.com/google/cel-go to v0.31.0 by @renovate[bot] in #1096

📖 Documentation

• docs: document v2 security hardening changes by @jkroepke in #1101

Full Changelog: v2.0.0-beta.6...v2.0.0-beta.7

v2.0.0-beta.6

What's Changed

🛠️ Dependencies

• chore(deps): update googleapis to 8efbd57 by @renovate[bot] in #1040
• chore(deps): update golang.org/x/exp digest to b88d891 by @renovate[bot] in #1039
• chore(deps): update module github.com/docker/go-connections to v0.8.1 by @renovate[bot] in #1043
• fix(deps): update module github.com/moby/moby/client to v0.5.1 by @renovate[bot] in #1044
• chore(deps): update module github.com/moby/go-archive to v0.3.0 by @renovate[bot] in #1046
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.48.1 by @renovate[bot] in #1045
• chore(deps): update module github.com/moby/go-archive to v0.3.1 by @renovate[bot] in #1056
• chore(deps): update module github.com/moby/go-archive to v0.3.2 by @renovate[bot] in #1058
• chore(deps): update googleapis to 6ac0973 by @renovate[bot] in #1076
• chore(deps): update module github.com/shirou/gopsutil/v4 to v4.26.7 by @renovate[bot] in #1077
• chore(deps): update opentelemetry-go monorepo to v1.45.0 by @renovate[bot] in #1078
• chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 by @renovate[bot] in #1075
• chore(deps): update module go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp to v0.70.0 by @renovate[bot] in #1079

📖 Documentation

• docs: add Okta provider configuration by @pikkemans in #1034

New Contributors

• @pikkemans made their first contribution in #1034

Full Changelog: v2.0.0-beta.5...v2.0.0-beta.6

v2.0.0-beta.5

What's Changed

💥 Breaking Changes

• feat!: remove openvpn.common-name.mode by @jkroepke in #1027
• feat!: remove http.short-url by @jkroepke in #1028

🐞 Bug Fixes

• fix: prevent OpenVPN plugin authentication races by @jkroepke in #1026

🛠️ Dependencies

• fix(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by @renovate[bot] in #1031

Full Changelog: v2.0.0-beta.4...v2.0.0-beta.5

v2.0.0-beta.4

What's Changed

💥 Breaking Changes

• feat!: replace the generic CONFIG_ environment prefix with OPENVPN_AUTH_OAUTH2_ by @jkroepke in #1014
• feat!: enforce strict configuration and expose OpenVPN command timeout by @jkroepke in #1016
• fix!: require octal notation for pass-through socket mode by @jkroepke in #1020
• feat!: validate CEL context fields at startup by @jkroepke in #1025

✨ Exciting New Features

• feat: Increase CEL library versions by @jkroepke in #1022

🐞 Bug Fixes

• fix: correct v2 release configuration by @jkroepke in #1013
• fix: publish client config before auth success by @jkroepke in #1015
• fix: route Zitadel OIDC logs through the configured logger by @jkroepke in #1024

🛠️ Dependencies

• chore(deps): update module github.com/docker/go-connections to v0.8.0 by @renovate[bot] in #1019
• fix(deps): update module github.com/google/cel-go to v0.30.0 by @renovate[bot] in #1021

📖 Documentation

• docs: document the CEL validation migration for v2 by @jkroepke in #1023

Full Changelog: v2.0.0-beta.3...v2.0.0-beta.4

v2.0.0-beta.3

What's Changed

💥 Breaking Changes

• feat!: normalize CEL identity context by @jkroepke in #1012

🐞 Bug Fixes

• fix: Propagate OpenVPN management command errors by @jkroepke in #1006
• fix: Preserve concurrently refreshed tokens during expiry cleanup by @jkroepke in #1009

🛠️ Dependencies

• chore(deps): update golang.org/x/exp digest to 764159d by @renovate[bot] in #997
• chore(deps): update googleapis to 3fe39f3 by @renovate[bot] in #998
• chore(deps): update module github.com/go-logr/logr to v1.4.4 by @renovate[bot] in #1000
• chore(deps): update module github.com/ebitengine/purego to v0.10.2 by @renovate[bot] in #999
• chore(deps): update module github.com/moby/go-archive to v0.2.1 by @renovate[bot] in #1002
• chore(deps): update module github.com/magiconair/properties to v1.18.11 by @renovate[bot] in #1004
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.48.0 by @renovate[bot] in #1005
• chore(deps): update module github.com/klauspost/compress to v1.19.1 by @renovate[bot] in #1001
• chore(deps): update googleapis to b2f2020 by @renovate[bot] in #1007

Full Changelog: v2.0.0-beta.2...v2.0.0-beta.3

v2.0.0-beta.2

What's Changed

✨ Exciting New Features

• feat: Drop existing sessions with same username by @jkroepke in #995

🐞 Bug Fixes

• fix: Avoid disconnect token lookup when refresh is disabled by @jkroepke in #979

🛠️ Dependencies

• chore(deps): update googleapis to f0a9213 by @renovate[bot] in #980
• chore(deps): update go module directive to v1.26.5 by @renovate[bot] in #981
• chore(deps): update module github.com/go-chi/chi/v5 to v5.3.1 by @renovate[bot] in #982
• fix(deps): update module github.com/google/cel-go to v0.29.2 by @renovate[bot] in #983
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.6 by @renovate[bot] in #984
• fix(deps): update golang.org/x by @renovate[bot] in #987
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.7 by @renovate[bot] in #988
• chore(deps): update googleapis to e75dac1 by @renovate[bot] in #989
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.9 by @renovate[bot] in #990

Full Changelog: v2.0.0-beta.1...v2.0.0-beta.2

v2.0.0-beta.1

Upgrade Guide

https://github.com/jkroepke/openvpn-auth-oauth2/wiki/Upgrade%20V2

What's Changed

💥 Breaking Changes

• feat!: Replace oauth2.openvpn-username-claim and oauth2.openvpn-username-cel with oauth2.openvpn-username by @jkroepke in #942
• feat!: Migrate legacy token validators (oauth2.validate.*) to CEL by @jkroepke in #943
• feat!: Remove --oauth2.validate.issuer by @jkroepke in #944
• feat!: Rename oauth2.validate.cel to oauth2.validate.expression by @jkroepke in #945
• feat!: Refactor client-config by @jkroepke in #949

✨ Exciting New Features

• feat: Mark OpenVPN Plugin as stable by @jkroepke in #946
• feat: require plugin management password by @jkroepke in #961

🐞 Bug Fixes

• fix(plugin): reject CR/LF in env values before building management messages by @jkroepke in #936
• fix(plugin): publish management connections only after password auth succeeds by @jkroepke in #935
• fix(plugin): write denied-auth reasons to auth_failed_reason_file by @jkroepke in #937
• fix(plugin): set plugin memory limit during plugin open by @jkroepke in #934
• fix: restrict OIDC HTTP redirects by @jkroepke in #960
• fix: trust proxy headers only from configured proxies by @jkroepke in #964
• fix: escape profile selector templates by @jkroepke in #966
• fix: redact plugin debug environment logs by @jkroepke in #967
• fix: bind pprof default to loopback by @jkroepke in #968
• fix: harden management line parsing by @jkroepke in #969
• fix: secure management pass-through access by @jkroepke in #963

🛠️ Dependencies

• chore(deps): update googleapis to b703f56 by @renovate[bot] in #932
• chore(deps): update module github.com/moby/sys/user to v0.4.1 by @renovate[bot] in #933
• chore(deps): update github.com/lufia/plan9stats digest to 477a660 by @renovate[bot] in #950
• chore(deps): update googleapis to 925bb5d by @renovate[bot] in #951
• chore(deps): update module github.com/shirou/gopsutil/v4 to v4.26.6 by @renovate[bot] in #952
• chore(deps): update module github.com/klauspost/compress to v1.19.0 by @renovate[bot] in #953
• fix(deps): update module github.com/google/cel-go to v0.29.0 by @renovate[bot] in #957
• fix(deps): update module github.com/google/cel-go to v0.29.1 by @renovate[bot] in #958

Full Changelog: v1.28.3...v2.0.0-beta.1

v1.28.3

What's Changed

🐞 Bug Fixes

• fix: Compile binaries with the amd64v1 target, reverting a regression introduced in 1.28.1 by @jkroepke in #931

Full Changelog: v1.28.2...v1.28.3

v1.28.2

What's Changed

🐞 Bug Fixes

• fix: OpenVPN plugin should also compile as amd64v2 which prevents duplicate deb files. by @jkroepke in #928

Full Changelog: v1.28.1...v1.28.2