Skip to content

Flagpost v1.3.0 — SAML & LDAP sign-in, encrypted secrets & venue mode

Latest
Latest

Choose a tag to compare

View all tags
@tbcsec tbcsec released this 04 Aug 22:07
· 27 commits to main since this release
v1.3.0
fcd540f

Flagpost v1.3.0 — external authentication rounded out (SAML + LDAP), secrets encrypted at rest, and a set of presentation and hardening improvements. All nine milestone issues shipped.

Pushing this tag builds and publishes the versioned GHCR images; source builds now report 1.3.0-src.

Authentication

  • SAML 2.0 identity providers (#100) — SP-initiated login as a second redirect kind on the ADR-0022 provider framework: signature-before-trust via python3-saml, InResponseTo/replay/XSW defences, persistent-NameID requirement, and an SP-metadata endpoint.
  • LDAP / Active Directory (#101) — the first non-redirect kind: a directory bind inside POST /api/auth/login, tried only after local password verification fails, so the break-glass owner never touches a directory and an outage never locks everyone out. TLS-mandatory with certificate validation, RFC 4515-escaped search, stable-id subject (never the DN), closed-posture email that can't hijack a local account by default, and the bind run off the event loop under a timeout.
  • External-identity admission policy (#118) — a per-provider trust posture (open/closed): public IdPs still pass the registration-open + email-domain gate, while an admin-configured directory is admitted by being enabled, closing the unverified-email account-takeover hole.

Security & hardening

  • Encrypted-at-rest facility for retrievable secrets (#109) — Fernet-backed EncryptedString (ADR-0020); the SMTP password, OIDC client secret, SAML SP key and LDAP bind password are all stored encrypted and stay out of portable backups.
  • Logo upload magic-byte check (#114) — uploads are content-sniffed (PNG/JPEG/GIF/SVG) rather than trusted by extension or content-type.
  • Single owner-provisioning helper (#133) — all owner-creation paths funnel through one helper that stamps setup_completed_at, so an install can't be left half-configured.

Presentation

  • Alternative challenge list view (#55) — a compact list alternative to the card grid, remembered per user.
  • Venue / projector mode (#77) — a big-screen public view for live events (scoreboard, first-blood splashes, insights).
  • Tabbed profile layout (#113).

Upgrade notes

No manual migration steps — alembic upgrade head runs on boot as usual, and the release adds no destructive schema changes. LDAP and SAML providers are configured under Admin → Site settings → Auth; both are optional and off until an administrator adds one.

Full changelog: v1.2.0...v1.3.0

Assets 2
Loading