v2.0.0

Upgrade Guide

https://github.com/jkroepke/openvpn-auth-oauth2/wiki/Upgrade%20V2

What's Changed

💥 Breaking Changes

• feat!: Replace oauth2.openvpn-username-claim and oauth2.openvpn-username-cel with oauth2.openvpn-username by @jkroepke in #942
• feat!: Migrate legacy token validators (oauth2.validate.*) to CEL by @jkroepke in #943
• feat!: Remove --oauth2.validate.issuer by @jkroepke in #944
• feat!: Rename oauth2.validate.cel to oauth2.validate.expression by @jkroepke in #945
• feat!: Refactor client-config by @jkroepke in #949
• fix: restrict OIDC HTTP redirects by @jkroepke in #960
• fix: trust proxy headers only from configured proxies by @jkroepke in #964
• fix: escape profile selector templates by @jkroepke in #966
• fix: bind pprof default to loopback by @jkroepke in #968
• feat: require plugin management password by @jkroepke in #961
• feat!: normalize CEL identity context by @jkroepke in #1012
• feat!: replace the generic CONFIG_ environment prefix with OPENVPN_AUTH_OAUTH2_ by @jkroepke in #1014
• feat!: enforce strict configuration and expose OpenVPN command timeout by @jkroepke in #1016
• fix!: require octal notation for pass-through socket mode by @jkroepke in #1020
• feat!: validate CEL context fields at startup by @jkroepke in #1025
• feat!: remove openvpn.common-name.mode by @jkroepke in #1027
• feat!: remove http.short-url by @jkroepke in #1028
• fix!: use the packaged client-config directory by default by @jkroepke in #1095
• feat!: normalize OAuth2 authentication style values by @jkroepke in #1099

✨ Exciting New Features

• feat: Mark OpenVPN Plugin as stable by @jkroepke in #946
• feat: Drop existing sessions with same username by @jkroepke in #995
• feat: Increase CEL library versions by @jkroepke in #1022

🐞 Bug Fixes

• fix(plugin): reject CR/LF in env values before building management messages by @jkroepke in #936
• fix(plugin): publish management connections only after password auth succeeds by @jkroepke in #935
• fix(plugin): write denied-auth reasons to auth_failed_reason_file by @jkroepke in #937
• fix(plugin): set plugin memory limit during plugin open by @jkroepke in #934
• fix: redact plugin debug environment logs by @jkroepke in #967
• fix: harden management line parsing by @jkroepke in #969
• fix: secure management pass-through access by @jkroepke in #963
• fix: resolve all matching Google groups by @jkroepke in #974
• fix: Avoid disconnect token lookup when refresh is disabled by @jkroepke in #979
• fix: Propagate OpenVPN management command errors by @jkroepke in #1006
• fix: Preserve concurrently refreshed tokens during expiry cleanup by @jkroepke in #1009
• fix: correct v2 release configuration by @jkroepke in #1013
• fix: publish client config before auth success by @jkroepke in #1015
• fix: route Zitadel OIDC logs through the configured logger by @jkroepke in #1024
• fix: prevent OpenVPN plugin authentication races by @jkroepke in #1026
• fix: validate CEL result type at startup by @jkroepke in #1073
• fix: halt replaced unique-user sessions by @jkroepke in #1104

🛠️ Dependencies

• chore(deps): update googleapis to b703f56 by @renovate[bot] in #932
• chore(deps): update googleapis to 925bb5d by @renovate[bot] in #951
• fix(deps): update module github.com/google/cel-go to v0.29.0 by @renovate[bot] in #957
• fix(deps): update module github.com/google/cel-go to v0.29.1 by @renovate[bot] in #958
• chore(deps): update googleapis to f0a9213 by @renovate[bot] in #980
• chore(deps): update go module directive to v1.26.5 by @renovate[bot] in #981
• chore(deps): update module github.com/go-chi/chi/v5 to v5.3.1 by @renovate[bot] in #982
• fix(deps): update module github.com/google/cel-go to v0.29.2 by @renovate[bot] in #983
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.6 by @renovate[bot] in #984
• fix(deps): update golang.org/x by @renovate[bot] in #987
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.7 by @renovate[bot] in #988
• chore(deps): update googleapis to e75dac1 by @renovate[bot] in #989
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.9 by @renovate[bot] in #990
• chore(deps): update golang.org/x/exp digest to 764159d by @renovate[bot] in #997
• chore(deps): update googleapis to 3fe39f3 by @renovate[bot] in #998
• chore(deps): update module github.com/go-logr/logr to v1.4.4 by @renovate[bot] in #1000
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.48.0 by @renovate[bot] in #1005
• chore(deps): update googleapis to b2f2020 by @renovate[bot] in #1007
• fix(deps): update module github.com/google/cel-go to v0.30.0 by @renovate[bot] in #1021
• fix(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by @renovate[bot] in #1031
• chore(deps): update googleapis to 8efbd57 by @renovate[bot] in #1040
• chore(deps): update golang.org/x/exp digest to b88d891 by @renovate[bot] in #1039
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.48.1 by @renovate[bot] in #1045
• chore(deps): update googleapis to 6ac0973 by @renovate[bot] in #1076
• fix(deps): update module github.com/zitadel/oidc/v3 to v3.49.2 by @renovate[bot] in #1084
• chore(deps): update googleapis to c8921c7 by @renovate[bot] in #1086
• chore(deps): update googleapis to ec0a776 by @renovate[bot] in #1087
• chore(deps): update go module directive to v1.26.6 by @renovate[bot] in #1088
• chore(deps): update module google.golang.org/protobuf to v1.36.12 by @renovate[bot] in #1090
• chore(deps): update module cel.dev/expr to v0.25.3 by @renovate[bot] in #1089
• fix(deps): update golang.org/x by @renovate[bot] in #1094
• fix(deps): update module github.com/google/cel-go to v0.31.0 by @renovate[bot] in #1096

📖 Documentation

• docs: add v2 upgrade notes by @jkroepke in #970
• docs: update the packaged v2 configuration example by @jkroepke in #1011
• docs: document the CEL validation migration for v2 by @jkroepke in #1023
• docs: add Okta provider configuration by @pikkemans in #1034
• docs: document v2 security hardening changes by @jkroepke in #1101

New Contributors

• @pikkemans made their first contribution in #1034

Full Changelog: v1.28.3...v2.0.0