Kaeso 0.3.9

Kaeso 0.3.9 adds a shell command for instance admin single sign-on and narrows sign-in again to options that can confirm a recent sign-in.

Highlights

• Sign-in again offers fewer options. Single sign-on is offered for a recent sign-in only when nothing else can confirm the account, and providers that cannot confirm are dropped. #361
• Instance admin SSO choice. Operators set the organization whose single sign-on may administer the instance with kaeso instance admin-sso, without editing the database. #360

Breaking

• Read confirms_sign_in for sends_auth_time, handle cannot_confirm for replaced sso_error codes, and expect sso empty when a password is available. #361

Added

• The kaeso instance admin-sso command sets the organization whose single sign-on may administer the instance, or clears it with none, from the server's shell. Installs without passwords or sign-in links could not set this before without editing the database. Each change is written to the audit log and applies at once. #360

Changed

• Documentation: The GitHub release page keeps its tagline, highlights and breaking changes, then lists every changelog entry under its section heading instead of linking to the full changelog. #359

Fixed

• Sign-in again offers single sign-on only when no password or sign-in link can confirm the account, so people are no longer sent back to a dialog that single sign-on cannot satisfy. A confirmation whose ID token has no auth_time, or a stale one, is refused with the cannot_confirm code, and the provider is no longer offered for recent sign-in. #361

Contributors: @dvnold

Full changelog · v0.3.8...v0.3.9